Censys warns that over 1.5 million Exim mail switch agent (MTA) cases are unpatched in opposition to a important vulnerability that lets risk actors bypass safety filters.
Tracked as CVE-2024-39929 and patched by Exim builders on Wednesday, the safety flaw impacts Exim releases as much as and together with model 4.97.1.
The vulnerability is because of the incorrect parsing of multiline RFC2231 header filenames, which may let distant attackers ship malicious executable attachments into finish customers’ mailboxes by circumventing the $mime_filename extension-blocking safety mechanism.
“If a person had been to obtain or run one in all these malicious recordsdata, the system might be compromised,” Censys warned, including that “a PoC is accessible, however no lively exploitation is understood but.”
“As of July 10, 2024, Censys observes 1,567,109 publicly uncovered Exim servers operating a probably susceptible model (4.97.1 or earlier), concentrated principally in the USA, Russia, and Canada,” the corporate added.
Whereas e mail recipients will nonetheless must launch the malicious attachment to be affected, the flaw permits risk actors to bypass safety checks based mostly on file extensions. This permits them to ship dangerous recordsdata which are usually blocked, corresponding to executables, into their targets’ mailboxes.
Admins who can’t instantly improve Exim are suggested to limit distant entry to their servers from the Web to dam incoming exploitation makes an attempt.
Thousands and thousands of servers uncovered on-line
MTA servers, corresponding to Exim, are sometimes focused in assaults as a result of they’re virtually at all times accessible by way of the Web, making them simple to seek out potential entry factors right into a goal’s community.
Exim can be the default Debian Linux MTA and is the world’s hottest MTA software program, based mostly on a mail server survey from earlier this month.
In response to the survey, over 59% of the 409,255 mail servers reachable on the Web throughout the survey had been operating Exim, representing simply over 241,000 Exim cases.
Additionally, per a Shodan search, over 3.3 million Exim servers are at the moment uncovered on-line, most in the USA, adopted by Russia and the Netherlands. Censys discovered 6,540,044 public-facing mail servers on-line, 4,830,719 (roughly 74%) operating Exim.
The Nationwide Safety Company (NSA) revealed in Might 2020 that the infamous Russian navy hacking group Sandworm has been exploiting a important CVE-2019-10149 Exim flaw (dubbed The Return of the WIZard) since not less than August 2019.
Extra just lately, in October, the Exim devs patched three zero-days disclosed by Development Micro’s Zero Day Initiative (ZDI), one in all them (CVE-2023-42115) exposing thousands and thousands of Web-exposed Exim servers to pre-auth RCE assaults.
