CVE-2020-7247criticalunder attackCWE-755

CVE-2020-7247

Published · Updated

Follow this CVE+ Monitor OpenSMTPD+ Monitor opensmtpd

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 99%
from disclosure to weaponsame day
Published on NVDJan 29
1st PoCJul 12
metasploitJan 28
CISA KEV+786d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Not affected
1 product — because the vulnerable code is not present in the product
red_hat_products
Action required by CISAfederal deadline: 2022-04-15

Apply updates per vendor instructions.

In short

OpenSMTPD 6.6 allows remote attackers to execute arbitrary commands as root through a crafted SMTP session with shell metacharacters in the MAIL FROM field. This is a critical vulnerability that affects the default configuration and can lead to complete system compromise.

Technical detail

A failure in input validation in smtp_mailaddr function of smtp_session.c causes an incorrect return value, allowing unauthenticated remote attackers to inject shell metacharacters via the MAIL FROM command. The vulnerability enables arbitrary command execution with root privileges on affected OpenBSD 6.6 systems running the default OpenSMTPD 6.6 configuration.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the "uncommented" default configuration. The issue exists because of an incorrect return value upon failure of input validation.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
public PoCs found — 31✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/47984exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/48038exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/48051githubgithub.com/FiroSolutions/cve-2020-7247-exploit★ 25githubgithub.com/QTranspose/CVE-2020-7247-exploit★ 11githubgithub.com/r0lh/CVE-2020-7247★ 5githubgithub.com/superzerosec/cve-2020-7247★ 4githubgithub.com/f4T1H21/CVE-2020-7247★ 2githubgithub.com/SimonSchoeni/CVE-2020-7247-POC★ 2githubgithub.com/presentdaypresenttime/shai_hulud★ 2githubgithub.com/minhluannguyen/CVE-2020-7247-reproducer★ 0githubgithub.com/solmin111/OpenSMTPD-CVE-2020-7247-★ 0githubgithub.com/CyberCTF/vulhub-opensmtpd-cve-2020-7247★ 0githubgithub.com/bytescrappers/CVE-2020-7247★ 0vulncheckvulncheck.com/xdb/aaf43d820afeunverifiedvulncheckvulncheck.com/xdb/bb8cd406d461unverifiedvulncheckvulncheck.com/xdb/3aba7d75651dunverifiedcve_referencepacketstormsecurity.com/files/162093/OpenBSD-OpenSMTPD-6.6-Remote-Code-Execution.htmlunverifiedvulncheckvulncheck.com/xdb/bf9da7b38b61unverifiedvulncheckvulncheck.com/xdb/0ec5ea51b20funverifiedvulncheckvulncheck.com/xdb/e74dfea19420unverifiedvulncheckvulncheck.com/xdb/84f50ceb9674unverifiedvulncheckvulncheck.com/xdb/fdc16adbecd8unverifiedcve_referencepacketstormsecurity.com/files/156249/OpenSMTPD-MAIL-FROM-Remote-Code-Execution.htmlunverifiedvulncheckvulncheck.com/xdb/79c490a79067unverifiedcve_referencepacketstormsecurity.com/files/156137/OpenBSD-OpenSMTPD-Privilege-Escalation-Code-Execution.htmlunverifiedcve_referencepacketstormsecurity.com/files/156145/OpenSMTPD-6.6.2-Remote-Code-Execution.htmlunverifiedcve_referencepacketstormsecurity.com/files/156295/OpenSMTPD-6.6.1-Local-Privilege-Escalation.htmlunverifiedvulncheckvulncheck.com/xdb/dfc825b4e351unverifiedvulncheckvulncheck.com/xdb/15de84180d62unverifiedvulncheckvulncheck.com/xdb/47eec17beab4unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.