published May 6, 2021
⚠️ A sneaky newline in a spool header could open the door for attackers! Exim 4 versions before 4.94.2 are vulnerable when configured with Delivery Status Notification (DSN) enabled. 🔥 Think of it like sending a postcard that accidentally includes a hidden message between the lines. Instead of just delivering your greetings, that secret could instruct someone to take actions you never intended! An attacker could exploit this vulnerability to execute arbitrary commands as the root user, giving them complete control over the server. This could lead to devastating data breaches or even a total system compromise, making it a serious concern for anyone running those Exim versions.
Think of it like sending a postcard that accidentally includes a hidden message between the lines. Instead of just delivering your greetings, that secret could instruct someone to take actions you never intended! The vulnerability arises from improper neutralization of line delimiters in Exim’s handling of Delivery Status Notifications. By crafting an ORCPT= header that includes a newline, an attacker can manipulate the spool file and execute commands remotely without authentication.
An attacker could exploit this vulnerability to execute arbitrary commands as the root user, giving them complete control over the server. This could lead to devastating data breaches or even a total system compromise, making it a serious concern for anyone running those Exim versions. To safeguard against this vulnerability, upgrade your Exim to version 4.94.2 or later. Review your configurations to ensure DSN is not enabling unnecessary risks, and consider applying additional hardening measures to your email server. You’ve got this! With a quick update and some careful review, you can keep your email servers secure. 🛡️