Barracuda Shell Command Injection Vulnerability

The Barracuda Email Security Gateway (ESG) appliance has a remote command injection vulnerability that affects versions 5.1.3.001–9.2.0.006.

This vulnerability was identified to be CVE-2023-2868, with a CVSS score of 9.8. It has been actively exploited since October 2022.

The flaw stems from a failure to comprehensively sanitize the processing of .tar files (tape archives).

Incomplete input validation of a user-supplied[.]tar file concerning the files’ names inside the archive leads to the vulnerability.

As a result, a remote attacker can construct these file names to enable remote system command execution using Perl’s qx operator and the Email Security Gateway product’s capabilities. 

As part of the BNSF-36456 patch, this problem was resolved. All appliances owned by customers had this patch deployed automatically.

Exploit For Barracuda Flaw

According to the Rapid7 reports, researchers used secondhand Barracuda ESG 300 with firmware version 8.0.1.001 for analysis. They quickly verified successful command execution against the actual device using ping and dig commands using the PoC and some basic fuzzing. 

They instantly validated that these commands functioned by using dnschef and wireshark on all traffic! The following payload, which was also stated in the Mandiant alert, was utilized to obtain shell access:

“We found references to amavisd in the filesystem. amavisd is part of amavisd-new, an interface between mailers and content checkers such as virus scanners (and the source of several Zimbra vulnerabilities last year, including the exploits for CVE-2022-30333 and CVE-2022-41352”, says the report.

All this, according to researchers, is crucial for processing .tar files.

Barracuda ESG is a service that filters inbound and outgoing emails while also securing customer data. ESG can be implemented as a physical or virtual appliance and on the public cloud on AWS or Microsoft Azure.

Barracuda has provided a comprehensive overview of the issue thus far, including significant signs of penetration, new vulnerability details, and details on the backdoored module for Barracuda’s SMTP daemon.

Reports say that based on a known ESG appliance that runs the “Barracuda Networks Spam Firewall” SMTP daemon, it looked to be around 11,000 appliances on the internet as of June 8 (Barracuda Networks Spam Firewall smtpd).

Hence, Barracuda Email Security Gateway users who have physical appliances should immediately update to the newest firmware.

“AI-based email security measures Protect your business From Email Threats!” – Request a Free Demo.