Tuesday, October 15, 2024
HomeCyber Security NewsExploit Released For Barracuda Shell Command Injection Vulnerability

Exploit Released For Barracuda Shell Command Injection Vulnerability

Published on

Malware protection

The Barracuda Email Security Gateway (ESG) appliance has a remote command injection vulnerability that affects versions 5.1.3.001–9.2.0.006.

This vulnerability was identified to be CVE-2023-2868, with a CVSS score of 9.8. It has been actively exploited since October 2022.

The flaw stems from a failure to comprehensively sanitize the processing of .tar files (tape archives).

- Advertisement - SIEM as a Service

Incomplete input validation of a user-supplied[.]tar file concerning the files’ names inside the archive leads to the vulnerability.

As a result, a remote attacker can construct these file names to enable remote system command execution using Perl’s qx operator and the Email Security Gateway product’s capabilities. 

As part of the BNSF-36456 patch, this problem was resolved. All appliances owned by customers had this patch deployed automatically.

Exploit For Barracuda Flaw

According to the Rapid7 reports, researchers used secondhand Barracuda ESG 300 with firmware version 8.0.1.001 for analysis. They quickly verified successful command execution against the actual device using ping and dig commands using the PoC and some basic fuzzing. 

They instantly validated that these commands functioned by using dnschef and wireshark on all traffic! The following payload, which was also stated in the Mandiant alert, was utilized to obtain shell access:

“We found references to amavisd in the filesystem. amavisd is part of amavisd-new, an interface between mailers and content checkers such as virus scanners (and the source of several Zimbra vulnerabilities last year, including the exploits for CVE-2022-30333 and CVE-2022-41352”, says the report.

All this, according to researchers, is crucial for processing .tar files.

Code Snippet of Perl file

Barracuda ESG is a service that filters inbound and outgoing emails while also securing customer data. ESG can be implemented as a physical or virtual appliance and on the public cloud on AWS or Microsoft Azure.

Barracuda has provided a comprehensive overview of the issue thus far, including significant signs of penetration, new vulnerability details, and details on the backdoored module for Barracuda’s SMTP daemon.

Reports say that based on a known ESG appliance that runs the “Barracuda Networks Spam Firewall” SMTP daemon, it looked to be around 11,000 appliances on the internet as of June 8 (Barracuda Networks Spam Firewall smtpd).

Hence, Barracuda Email Security Gateway users who have physical appliances should immediately update to the newest firmware.

“AI-based email security measures Protect your business From Email Threats!” – .

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Hackers Allegedly Selling Data Stolen from Cisco

A group of hackers reportedly sells sensitive data stolen from Cisco Systems, Inc.The...

Fortigate SSLVPN Vulnerability Exploited in the Wild

A critical vulnerability in Fortinet's FortiGate SSLVPN appliances, CVE-2024-23113, has been actively exploited in...

Splunk Enterprise Vulnerabilities let Attackers Execute Remote Code

Splunk has disclosed multiple vulnerabilities affecting its Enterprise product, which could allow attackers to...

OilRig Hackers Exploiting Microsoft Exchange Server To Steal Login Details

Earth Simnavaz, an Iranian state-sponsored cyber espionage group, has recently intensified its attacks on...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

Hackers Allegedly Selling Data Stolen from Cisco

A group of hackers reportedly sells sensitive data stolen from Cisco Systems, Inc.The...

Fortigate SSLVPN Vulnerability Exploited in the Wild

A critical vulnerability in Fortinet's FortiGate SSLVPN appliances, CVE-2024-23113, has been actively exploited in...

Splunk Enterprise Vulnerabilities let Attackers Execute Remote Code

Splunk has disclosed multiple vulnerabilities affecting its Enterprise product, which could allow attackers to...