Vulnerability · Published Jul 11, 2022 · Assigned by GitHub_M
CVE-2022-31138OS Command Injection in mailcow
High 8.8
In plain English
A high-severity OS command injection in mailcow-dockerized from mailcow. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 3.3% (higher than 88% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
mailcow is a mailserver suite. Prior to mailcow-dockerized version 2022-06a, an extended privilege vulnerability can be exploited by manipulating the custom parameters regexmess, skipmess, regexflag, delete2foldersonly, delete2foldersbutnot, regextrans2, pipemess, or maxlinelengthcmd to execute arbitrary code. Users should update their mailcow instances with the `update.sh` script in the mailcow root directory to 2022-06a or newer to receive a patch for this issue. As a temporary workaround, the Syncjob ACL can be removed from all mailbox users, preventing changes to those settings.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| mailcow | mailcow-dockerized | < 2022-06a |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-vx9w-h33p-5vhc x_refsource_CONFIRM
- https://github.com/mailcow/mailcow-dockerized/commit/d373164e13a14e058f82c9f1918a5612f375a9f9 x_refsource_MISC
- https://github.com/ly1g3/Mailcow-CVE-2022-31138 x_refsource_MISC
- https://github.com/mailcow/mailcow-dockerized/releases/tag/2022-06a x_refsource_MISC