CVE-2024-35187

Executive Summary

CVE-2024-35187 is a critical privilege escalation vulnerability in Stalwart Mail Server, an open-source mail server. The flaw allows an attacker who has already achieved arbitrary code execution as the stalwart-mail user (e.g., via a web interface admin compromise or another vulnerability) to escalate privileges to full root access on the system. This effectively bypasses the intended security isolation of running the mail service as a non-root user, granting complete control over the host. The vulnerability has a CVSS score of 9.1 (Critical) and affects all versions prior to 0.8.0. The patch is included in version 0.8.0.

Supply Chain & Package Security

This vulnerability is not directly related to a package manager (NPM, PyPI, Go, Ruby) but affects the Stalwart Mail Server binary distribution. Administrators should verify the integrity of their downloaded binaries using official checksums and signatures to prevent supply chain attacks.

CVSS Breakdown & Threat Level

• CVSS Score: 9.1 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
• Attack Vector (AV): Network (N) – The initial compromise may be remote, but the privilege escalation itself is local.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs stalwart-mail user access.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Changed (C) – Escalation impacts resources beyond the vulnerable component.
• Confidentiality (C): High (H) – Full system access.
• Integrity (I): High (H) – Full system control.
• Availability (A): High (H) – Potential for denial of service or destruction.

Threat Level: Critical. Exploitation is straightforward once initial access is gained, leading to full system compromise.

Deep Dive & Mechanics

The vulnerability stems from a design flaw in how Stalwart Mail Server manages its privileges. The server runs as a dedicated stalwart-mail user for security isolation. However, the application retains the capability to re-escalate its privileges to root through a mechanism that is not properly restricted. This could be due to:

• Setuid/Setgid binaries: The server may have a helper binary with the setuid root bit set that can be invoked by the stalwart-mail user.
• Capabilities: The server might be granted Linux capabilities (e.g., CAP_SETUID, CAP_SETGID) that allow it to change its UID back to root.
• D-Bus or IPC: The server could communicate with a privileged system service that grants root access without proper authentication.
• File-based privilege escalation: The server may write to a file that is later executed by a root cron job or systemd service.

The core issue is that the stalwart-mail user is not truly sandboxed; it can trivially regain root privileges, defeating the purpose of running as a non-root user.

Vulnerable vs. Patched Code

Vulnerable (pre-0.8.0): The server likely contains a mechanism to drop privileges on startup but retains the ability to re-elevate. For example, it might use setuid(0) or setresuid() without proper checks.

// Vulnerable pseudocode
void drop_privileges() {
    // Drop to stalwart-mail user
    setuid(stalwart_mail_uid);
}

void escalate_privileges() {
    // No check - can always go back to root
    setuid(0);
}

Patched (0.8.0): The patch removes or restricts the privilege escalation capability. The server should permanently drop privileges and not retain any capability to regain root.

// Patched pseudocode
void drop_privileges() {
    // Permanently drop privileges
    if (setuid(stalwart_mail_uid) != 0) {
        // Error handling
    }
    // Disable any saved set-user-ID
    if (setresuid(-1, stalwart_mail_uid, stalwart_mail_uid) != 0) {
        // Error handling
    }
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to a vulnerable Stalwart Mail Server (version < 0.8.0).
• Ability to execute arbitrary code as the stalwart-mail user (e.g., via a web admin account or another vulnerability).

Exploitation Steps:

1. Gain initial access: Exploit another vulnerability or use admin credentials to execute code as stalwart-mail.
2. Escalate privileges: Use the built-in privilege escalation mechanism. This could be as simple as calling a setuid binary or sending a command via IPC.

# Example: If a setuid binary exists
/usr/lib/stalwart-mail/stalwart-priv-helper --escalate

# Or using capabilities
capsh --uid=0 -- -c "id"

3. Verify root access:

id
# Output: uid=0(root) gid=0(root) groups=0(root)

4. Maintain persistence: Create a root backdoor or modify system files.

Blue Team (Detection & Defense)

Detection:

• Monitor for unexpected privilege escalation events (e.g., setuid syscalls by stalwart-mail).
• Alert on any process running as stalwart-mail that spawns a child process as root.
• Monitor for unusual file writes by stalwart-mail to system directories (e.g., /etc/cron.d/, /etc/systemd/system/).

Defense:

• Immediately upgrade to version 0.8.0 or later.
• If patching is not possible, restrict the stalwart-mail user's capabilities using capsh or AppArmor/SELinux.
• Monitor logs for setuid calls from the stalwart-mail user.
• Implement strict file integrity monitoring (e.g., AIDE, Tripwire) on critical system files.

Indicators of Compromise (IOCs)

• Process: stalwart-mail process spawning a child process with UID 0.
• File: Unexpected files in /etc/cron.d/, /etc/systemd/system/, or /root/ owned by stalwart-mail.
• Log: Syslog entries showing setuid or setresuid calls from PID of stalwart-mail.
• Network: Outbound connections from root-owned processes that were not initiated by legitimate system services.
• User: New user accounts or modifications to /etc/passwd or /etc/shadow by stalwart-mail.

Detection Engineering

YARA Rule

rule CVE_2024_35187_Privilege_Escalation {
    meta:
        description = "Detects potential exploitation of CVE-2024-35187 in Stalwart Mail Server"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-35187"
    strings:
        $s1 = "stalwart-mail" ascii wide nocase
        $s2 = "setuid" ascii wide nocase
        $s3 = "setresuid" ascii wide nocase
        $s4 = "CAP_SETUID" ascii wide nocase
    condition:
        $s1 and any of ($s2, $s3, $s4)
}

Sigma Rule

title: CVE-2024-35187 - Stalwart Mail Server Privilege Escalation
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects privilege escalation attempts by the stalwart-mail user
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        User: "stalwart-mail"
        Image|endswith: 
            - "/bin/bash"
            - "/bin/sh"
            - "/usr/bin/id"
        ParentImage|endswith: "/stalwart-mail"
    condition: selection
falsepositives:
    - Legitimate administrative actions (rare)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-35187 - Stalwart Mail Server Privilege Escalation - Outbound Root Shell"; flow:to_server,established; content:"uid=0(root)"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update Stalwart Mail Server to version 0.8.0 or later.
2. Restrict Capabilities: If upgrade is delayed, remove any Linux capabilities from the stalwart-mail binary:

   setcap -r /usr/sbin/stalwart-mail
   

3. AppArmor/SELinux: Enforce a strict policy that prevents the stalwart-mail user from executing setuid binaries or changing UID.

Long-term Measures:

• Implement the principle of least privilege for all services.
• Regularly audit system binaries for unnecessary setuid/setgid bits.
• Monitor CVEs for Stalwart Mail Server and apply patches promptly.
• Use a security-focused mail server or containerize the service.

Valters IT – Securing your infrastructure, one CVE at a time.