Saturday, March 2, 2024

Exploit Released For Barracuda Shell Command Injection Vulnerability

The Barracuda Email Security Gateway (ESG) appliance has a remote command injection vulnerability that affects versions–

This vulnerability was identified to be CVE-2023-2868, with a CVSS score of 9.8. It has been actively exploited since October 2022.

The flaw stems from a failure to comprehensively sanitize the processing of .tar files (tape archives).

Incomplete input validation of a user-supplied[.]tar file concerning the files’ names inside the archive leads to the vulnerability.

As a result, a remote attacker can construct these file names to enable remote system command execution using Perl’s qx operator and the Email Security Gateway product’s capabilities. 

As part of the BNSF-36456 patch, this problem was resolved. All appliances owned by customers had this patch deployed automatically.

Exploit For Barracuda Flaw

According to the Rapid7 reports, researchers used secondhand Barracuda ESG 300 with firmware version for analysis. They quickly verified successful command execution against the actual device using ping and dig commands using the PoC and some basic fuzzing. 

They instantly validated that these commands functioned by using dnschef and wireshark on all traffic! The following payload, which was also stated in the Mandiant alert, was utilized to obtain shell access:

“We found references to amavisd in the filesystem. amavisd is part of amavisd-new, an interface between mailers and content checkers such as virus scanners (and the source of several Zimbra vulnerabilities last year, including the exploits for CVE-2022-30333 and CVE-2022-41352”, says the report.

All this, according to researchers, is crucial for processing .tar files.

Code Snippet of Perl file

Barracuda ESG is a service that filters inbound and outgoing emails while also securing customer data. ESG can be implemented as a physical or virtual appliance and on the public cloud on AWS or Microsoft Azure.

Barracuda has provided a comprehensive overview of the issue thus far, including significant signs of penetration, new vulnerability details, and details on the backdoored module for Barracuda’s SMTP daemon.

Reports say that based on a known ESG appliance that runs the “Barracuda Networks Spam Firewall” SMTP daemon, it looked to be around 11,000 appliances on the internet as of June 8 (Barracuda Networks Spam Firewall smtpd).

Hence, Barracuda Email Security Gateway users who have physical appliances should immediately update to the newest firmware.

“AI-based email security measures Protect your business From Email Threats!” – Request a Free Demo.


Latest articles

AI Worm Developed by Researchers Spreads Automatically Between AI Agents

Researchers have developed what they claim to be one of the first generative AI...

20 Million+ Cutout.Pro User Records Leaked On Hacking Forums

CutOut.Pro, an AI-powered photo and video editing platform, has reportedly suffered a data breach,...

CWE Version 4.14 Released: What’s New!

The Common Weakness Enumeration (CWE) project, a cornerstone in the cybersecurity landscape, has unveiled...

RisePro Stealer Attacks Windows Users Steals Sensitive Data

A new wave of cyber threats has emerged as the RisePro information stealer targets...

Golden Corral Restaurant Chain Hacked: 180,000+ Users’ Data Stolen

The Golden Corral Corporation, a popular American restaurant chain, has suffered a significant data...

CISA Warns Of Hackers Exploiting Multiple Flaws In Ivanti VPN

Threat actors target and abuse VPN flaws because VPNs are often used to secure...

BEAST AI Jailbreak Language Models Within 1 Minute With High Accuracy

Malicious hackers sometimes jailbreak language models (LMs) to exploit bugs in the systems so...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Live Account Takeover Attack Simulation

Live Account Take Over Attack

Live Webinar on How do hackers bypass 2FA ,Detecting ATO attacks, A demo of credential stuffing, brute force and session jacking-based ATO attacks, Identifying attacks with behaviour-based analysis and Building custom protection for applications and APIs.

Related Articles