Most of Exim email servers could be hacked by exploiting 21Nails flaws

The maintainers of the Exim email server software addressed a collection of 21 issues, dubbed 21Nails, that can allow attackers to fully compromise mail servers.

The maintainers of the Exim email server software have released security updates to address a collection of 21 vulnerabilities, dubbed 21Nails, that can be exploited by attackers to take over servers and access email traffic through them.

Exim is a free mail transfer agent (MTA) used on Unix-like operating systems, 59% of all MTA solutions used worldwide are Exim as of May 2021. At the time of writing, querying the Shodan search engine we can find that more than 3.86 million Exim servers are exposed online.

The vulnerabilities were discovered by security firm Qualys, experts recommend to update installs to Exim version 4.94.

The 21Nails vulnerabilities, if left unpatched, could allow threat actors to take over these systems and then intercept or tamper with email communications passing through the Exim server.

11 issues are local vulnerabilities, while 10 of them could be remotely exploited, experts pointed out all Exim server versions released since2004 are affected. Below the list of bugs discovered by Qualys:

Local vulnerabilities

– CVE-2020-28007: Link attack in Exim’s log directory

– CVE-2020-28008: Assorted attacks in Exim’s spool directory

– CVE-2020-28014: Arbitrary file creation and clobbering

– CVE-2021-27216: Arbitrary file deletion

– CVE-2020-28011: Heap buffer overflow in queue_run()

– CVE-2020-28010: Heap out-of-bounds write in main()

– CVE-2020-28013: Heap buffer overflow in parse_fix_phrase()

– CVE-2020-28016: Heap out-of-bounds write in parse_fix_phrase()

– CVE-2020-28015: New-line injection into spool header file (local)

– CVE-2020-28012: Missing close-on-exec flag for privileged pipe

– CVE-2020-28009: Integer overflow in get_stdinput()

Remote vulnerabilities

– CVE-2020-28017: Integer overflow in receive_add_recipient()

– CVE-2020-28020: Integer overflow in receive_msg()

– CVE-2020-28023: Out-of-bounds read in smtp_setup_msg()

– CVE-2020-28021: New-line injection into spool header file (remote)

– CVE-2020-28022: Heap out-of-bounds read and write in extract_option()

– CVE-2020-28026: Line truncation and injection in spool_read_header()

– CVE-2020-28019: Failure to reset function pointer after BDAT error

– CVE-2020-28024: Heap buffer underflow in smtp_ungetc()

– CVE-2020-28018: Use-after-free in tls-openssl.c

– CVE-2020-28025: Heap out-of-bounds read in pdkim_finish_bodyhash()

Experts have not tried to exploit all of these vulnerabilities, they explained that successfully exploited 4 LPEs (Local Privilege Escalations) and 3 RCEs (Remote Code Executions):

• CVE-2020-28007 (LPE, from user “exim” to root);
• CVE-2020-28008 (LPE, from user “exim” to root);
• CVE-2020-28015 (LPE, from any user to root);
• CVE-2020-28012 (LPE, from any user to root, if allow_filter is true);
• CVE-2020-28020 (unauthenticated RCE as “exim”, in Exim < 4.92);
• CVE-2020-28018 (unauthenticated RCE as “exim”, in 4.90 <= Exim < 4.94, if TLS encryption is provided by OpenSSL);
• CVE-2020-28021 (authenticated RCE, as root);
• CVE-2020-28017 is also exploitable (unauthenticated RCE as “exim”), but requires more than 25GB of memory in the default configuration.

Experts announced they will not publish that exploits for now.

This is not the first time that experts disclose vulnerabilities in EXIM software, in May 2020 the U.S. National Security Agency (NSA) warned that Russia-linked APT group tracked Sandworm Team were exploiting a critical vulnerability (CVE-2019-10149) in the Exim mail transfer agent (MTA) software since at least August 2019.

In September 2019, Exim maintainers released an urgent security update, Exim version 4.92.3, to address a critical security vulnerability that could allow a remote attacker to crash or potentially execute malicious code on targeted email servers.

The flaw is a heap-based buffer overflow, tracked as CVE-2019-16928, that resides in the string_vformat (string.c). An attacker could exploit the flaw using an extraordinary long EHLO string to crash the Exim process that is receiving the message.

Early September, the Exim development team  addressed another vulnerability in the popular mail server, tracked as CVE-2019-15846. The vulnerability could be exploited by local and remote attackers to execute arbitrary code with root privileges.

If you want to receive the weekly Security Affairs Newsletter for free subscribe here.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini
International Editor-in-Chief
Cyber Defense Magazine