CVE-2025-26794

Executive Summary

CVE-2025-26794 is a critical SQL injection vulnerability in Exim 4.98 (prior to 4.98.1) that affects the SQLite hints and ETRN serialization functionality. An unauthenticated remote attacker can exploit this flaw to inject arbitrary SQL commands into the SQLite database used for hint storage and ETRN serialization. The vulnerability arises from improper sanitization of input passed to SQL queries when handling ETRN commands or hint lookups. Successful exploitation could lead to unauthorized data access, modification, or deletion of the SQLite database, potentially disrupting mail delivery and exposing sensitive information. The CVSS score is 7.5 (High), with a network attack vector and no authentication required. No public proof-of-concept or exploit code is currently available, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time. However, given the widespread use of Exim as an MTA, this vulnerability poses a significant risk to unpatched systems.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects the Exim mail transfer agent, which is typically distributed via operating system package managers (e.g., apt, yum) or compiled from source. Organizations should verify their Exim version and apply the patch from their OS vendor or the official Exim source.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network (AV:N) – Exploitable remotely over the network.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: High (C:H) – Potential full database read access.
• Integrity Impact: None (I:N) – No data modification via this vector.
• Availability Impact: None (A:N) – No direct denial of service.

Threat Level: High. The vulnerability is remotely exploitable without authentication, and while no public exploit exists, the attack surface is significant due to Exim's widespread deployment.

Deep Dive & Mechanics

The vulnerability resides in Exim's handling of SQLite hints and ETRN serialization. Exim uses SQLite to store hints (e.g., for rate limiting, retry schedules) and to serialize ETRN (Extended Turn) commands. When processing ETRN commands or performing hint lookups, user-supplied input is concatenated into SQL queries without proper sanitization or parameterization.

Specifically, the flaw is in the hints_db and etrn_serialize functions. When an ETRN command is received, Exim constructs an SQL query to check or update the serialization state. The input from the ETRN command (e.g., the domain name) is directly interpolated into the SQL statement. Similarly, hint lookups for rate limiting or retry schedules may use unsanitized input.

For example, a malicious ETRN command like:

ETRN example.com; DROP TABLE hints;

could be injected into an SQL query such as:

SELECT * FROM hints WHERE domain = 'example.com; DROP TABLE hints;'

This would execute the injected SQL, potentially dropping the hints table or extracting data.

The vulnerability is present in Exim 4.98 and is fixed in 4.98.1. However, for certain non-default rate-limit configurations, the fix requires an update to 4.99.1 due to additional changes in the rate-limit code path.

Vulnerable vs. Patched Code

Vulnerable Code (Exim 4.98): In src/hints.c, the function hints_get constructs an SQL query using string formatting:

snprintf(query, sizeof(query), "SELECT data FROM hints WHERE key = '%s'", key);

Where key is user-supplied input from the ETRN command or hint lookup. No escaping or parameterization is applied.

Patched Code (Exim 4.98.1): The fix uses SQLite prepared statements with parameter binding:

sqlite3_prepare_v2(db, "SELECT data FROM hints WHERE key = ?", -1, &stmt, NULL);
sqlite3_bind_text(stmt, 1, key, -1, SQLITE_STATIC);

This prevents SQL injection by treating user input as data, not executable code.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Exim 4.98 running with SQLite hints enabled (default in many configurations).
• Network access to the SMTP port (25) or submission port (587).

Exploitation Steps:

1. Connect to the Exim server via SMTP.
2. Send a crafted ETRN command with SQL injection payload:

   EHLO attacker
   MAIL FROM:<test@test.com>
   RCPT TO:<test@test.com>
   DATA
   Subject: test
   .
   ETRN example.com' UNION SELECT sql FROM sqlite_master WHERE type='table' --
   

3. The injected SQL will be executed, potentially returning table schemas or data.

Note: No public exploit code is available. The above is a conceptual example.

Blue Team (Defensive)

Detection:

• Monitor SMTP logs for unusual ETRN commands containing SQL keywords (e.g., UNION, SELECT, DROP, INSERT).
• Enable SQLite query logging in Exim (if supported) to capture injected queries.
• Use network intrusion detection to flag suspicious SMTP traffic.

Hunting:

• Search for ETRN commands with single quotes or SQL syntax in mail logs.
• Check for unexpected SQLite database modifications or errors in Exim logs.

Indicators of Compromise (IOCs)

• Network: SMTP traffic containing ETRN commands with SQL keywords (e.g., ' UNION SELECT, ' OR '1'='1).
• Logs: Exim mainlog entries showing failed SQLite queries or errors like "SQL logic error" or "near ... syntax error".
• File System: Unusual SQLite database files in /var/spool/exim/db/ with unexpected content or corruption.
• Process: Exim processes consuming abnormal CPU or memory due to SQL injection attempts.

Detection Engineering

YARA Rule

rule CVE_2025_26794_Exim_SQLi {
    meta:
        description = "Detects SQL injection attempts against Exim SQLite hints via ETRN commands"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-26794"
    strings:
        $s1 = "ETRN" ascii wide nocase
        $s2 = "UNION" ascii wide nocase
        $s3 = "SELECT" ascii wide nocase
        $s4 = "DROP" ascii wide nocase
        $s5 = "'" ascii wide
    condition:
        $s1 and (any of ($s2,$s3,$s4) or #s5 > 2)
}

Sigma Rule

title: Exim SQL Injection via ETRN Command
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts against Exim SQLite hints via ETRN commands
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: exim
detection:
    selection:
        EventID: 1234  # Example Exim event ID for ETRN
        Command: "ETRN"
        Payload|contains:
            - "'"
            - "UNION"
            - "SELECT"
            - "DROP"
    condition: selection
falsepositives:
    - Legitimate ETRN commands with special characters (rare)
level: high

Suricata Rule

alert tcp any any -> any 25 (msg:"CVE-2025-26794 Exim SQL Injection via ETRN"; flow:to_server,established; content:"ETRN"; nocase; content:"'"; distance:0; within:100; content:"UNION|SELECT|DROP"; nocase; distance:0; within:200; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade Exim to version 4.98.1 or later. For systems with non-default rate-limit configurations, upgrade to 4.99.1.
2. Workaround: If patching is not immediately possible, disable SQLite hints and ETRN serialization by setting hints_db = false and etrn_serialize = false in the Exim configuration file. Note that this may impact functionality.
3. Network Filtering: Restrict SMTP access to trusted IPs only using firewall rules or TCP wrappers.

Long-Term Measures:

• Implement regular vulnerability scanning for Exim and other MTAs.
• Use a Web Application Firewall (WAF) or SMTP proxy to inspect and filter malicious ETRN commands.
• Enable detailed logging and monitoring for Exim to detect exploitation attempts.

Valters IT – Securing your infrastructure, one CVE at a time.