CVE-2024-35179

Executive Summary

CVE-2024-35179 is a privilege escalation vulnerability in the Stalwart Mail Server, an open-source mail server. The flaw exists in versions prior to 0.8.0 when the server is configured with the RUN_AS_USER directive. This setting is intended to drop privileges from root to a specified user for normal operations. However, due to improper privilege management, the specified user (and consequently, any web interface admin with valid credentials) can read arbitrary files on the system as the root user. This effectively bypasses the intended privilege separation.

The vulnerability is particularly dangerous in scenarios where an attacker has already achieved Arbitrary Code Execution (ACE) through another vulnerability, or where a malicious admin with low-level credentials seeks to escalate privileges. The CVSS score of 6.8 reflects a high impact on confidentiality and integrity, but the attack vector is local and requires high privileges (admin credentials or prior ACE). The EPSS score of 0.0% indicates that this vulnerability is not currently being actively exploited in the wild, but the risk remains for targeted attacks.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct code-level flaw in the Stalwart Mail Server application. The patch is available in version 0.8.0, which should be obtained from the official Stalwart repository.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) – The attacker must have local access to the system or be able to execute code as the RUN_AS_USER user.
• Attack Complexity (AC): Low (L) – No special conditions are required to exploit the flaw once the attacker has the necessary privileges.
• Privileges Required (PR): High (H) – The attacker needs admin credentials to the mail server or must have achieved ACE via another vulnerability.
• User Interaction (UI): None (N) – No user interaction is required beyond the attacker's own actions.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Arbitrary file read as root can expose sensitive data, including passwords, keys, and configuration files.
• Integrity (I): High (H) – The attacker can read and potentially modify system files, leading to full system compromise.
• Availability (A): None (N) – The vulnerability does not directly impact availability.

Threat Level: High. While the EPSS score is low, the potential impact is severe, and the attack complexity is low once the prerequisite privileges are obtained.

Deep Dive & Mechanics

The vulnerability stems from the RUN_AS_USER feature in Stalwart Mail Server. This feature is designed to allow the server to run with reduced privileges after binding to privileged ports (e.g., port 25, 143, 993) as root. The server initially starts as root, binds to the required ports, and then drops privileges to the specified user.

The flaw occurs because the privilege drop is not fully enforced for all file system operations. Specifically, when the server is running as the RUN_AS_USER, it retains the ability to read files owned by root or with root-only permissions. This is likely due to the server not properly setting the effective user ID (eUID) or not dropping supplementary groups that grant root access.

An attacker who has gained admin access to the web interface (or has achieved ACE via another vulnerability) can exploit this by crafting requests that read arbitrary files. For example, they could read /etc/shadow, /root/.ssh/id_rsa, or other sensitive files. The server, running with the RUN_AS_USER but still having root-level file read capabilities, will return the contents of these files.

The attack chain is:

1. Attacker gains admin credentials to the Stalwart web interface (e.g., via phishing, weak passwords, or another vulnerability).
2. Attacker logs in and uses a feature that reads files (e.g., configuration file viewer, log viewer, or a custom API endpoint).
3. The server, due to the privilege escalation flaw, reads the requested file as root and returns it to the attacker.

Vulnerable vs. Patched Code

The vulnerable code is in the privilege dropping mechanism. In versions prior to 0.8.0, the server does not properly set the eUID after dropping privileges, or it fails to drop all root capabilities.

Vulnerable Code (Conceptual):

// Pseudocode for vulnerable version
void drop_privileges(const char *user) {
    // Set the real, effective, and saved user IDs to the target user
    // But does not drop all capabilities or supplementary groups
    setuid(user_uid);
    // Missing: setgid(), setgroups(), cap_set_proc()
}

Patched Code (Conceptual):

// Pseudocode for patched version 0.8.0
void drop_privileges(const char *user) {
    // Properly drop all privileges
    setgid(user_gid);
    setgroups(0, NULL); // Drop all supplementary groups
    setuid(user_uid);
    // Also drop all capabilities
    cap_t caps = cap_get_proc();
    cap_clear(caps);
    cap_set_proc(caps);
    cap_free(caps);
}

The patch ensures that after dropping privileges, the process has no residual root capabilities or group memberships that could allow reading root-owned files.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A Stalwart Mail Server running version < 0.8.0 with RUN_AS_USER configured.
• Admin credentials to the web interface (or another vulnerability to achieve ACE).

Exploitation Steps:

1. Identify the Target: Scan for Stalwart Mail Server instances. The default web interface is typically on port 8080 or 443.

   nmap -p 8080,443 --script http-title <target_ip>
   

2. Gain Admin Access: Use stolen credentials, brute-force, or another vulnerability to log in to the web interface.

3. Exploit the File Read: The web interface may have a feature to read configuration files or logs. Craft a request to read a sensitive file.

   GET /api/v1/config/read?file=/etc/shadow HTTP/1.1
   Host: <target_ip>:8080
   Authorization: Bearer <admin_token>
   

4. Extract Data: The server will return the contents of /etc/shadow or other files, allowing for password cracking or further privilege escalation.

Alternative Exploit (if ACE is achieved): If the attacker has a shell as the RUN_AS_USER, they can directly read files:

cat /etc/shadow

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual file read requests to sensitive files (e.g., /etc/shadow, /root/.ssh/).
• Alert on admin users accessing files outside their expected scope (e.g., reading system files from the web interface).
• Use the YARA and Sigma rules provided in the Detection Engineering section.

Defense:

• Immediately upgrade to Stalwart Mail Server version 0.8.0 or later.
• If upgrade is not possible, restrict the RUN_AS_USER account's capabilities using Linux capabilities and AppArmor/SELinux.
• Implement strict access controls on the web interface, including multi-factor authentication.
• Monitor logs for privilege escalation attempts.

Indicators of Compromise (IOCs)

• File Access Patterns: Unauthorized reads of /etc/shadow, /etc/sudoers, /root/.ssh/authorized_keys, or other sensitive files.
• Web Interface Logs: Requests to endpoints like /api/v1/config/read or similar with file paths pointing to system files.
• System Logs: auditd logs showing the RUN_AS_USER process reading files owned by root.
• Network Traffic: Outbound connections from the server to an attacker-controlled IP after file exfiltration.

Detection Engineering

YARA Rule

rule CVE_2024_35179_Stalwart_PrivEsc {
    meta:
        description = "Detects attempts to exploit CVE-2024-35179 in Stalwart Mail Server"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-35179"
    strings:
        $s1 = "/etc/shadow" ascii wide nocase
        $s2 = "/root/.ssh/" ascii wide nocase
        $s3 = "/etc/sudoers" ascii wide nocase
        $s4 = "RUN_AS_USER" ascii wide nocase
    condition:
        any of ($s1, $s2, $s3) and $s4
}

Sigma Rule

title: CVE-2024-35179 Stalwart Mail Server Privilege Escalation
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to read sensitive files via Stalwart Mail Server web interface
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: stalwart
detection:
    selection:
        cs-uri-query|contains:
            - '/etc/shadow'
            - '/root/.ssh/'
            - '/etc/sudoers'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-35179 Stalwart Mail Server Privilege Escalation Attempt"; flow:to_server,established; content:"/etc/shadow"; http_uri; nocase; sid:1000001; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-35179 Stalwart Mail Server Privilege Escalation Attempt"; flow:to_server,established; content:"/root/.ssh/"; http_uri; nocase; sid:1000002; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-35179 Stalwart Mail Server Privilege Escalation Attempt"; flow:to_server,established; content:"/etc/sudoers"; http_uri; nocase; sid:1000003; rev:1;)

Remediation & Mitigation

Immediate Remediation:

• Upgrade to Stalwart Mail Server version 0.8.0 or later. This is the only complete fix.

Mitigation (if upgrade is not possible):

• Remove the RUN_AS_USER directive from the configuration and run the server as a non-root user from the start (if possible).
• Use Linux Security Modules (AppArmor/SELinux) to restrict the RUN_AS_USER process from reading files outside its expected directories.
• Implement strict file system permissions: ensure that sensitive files (e.g., /etc/shadow) are not readable by the RUN_AS_USER group.
• Monitor and audit all file read operations by the Stalwart process.

Long-term Prevention:

• Apply the principle of least privilege: ensure that the server drops all capabilities and supplementary groups after binding to ports.
• Regularly update all software components.
• Conduct security audits of privilege management code.

Valters IT