Censys warns that over 1.5 million Exim mail switch agent (MTA) cases are unpatched towards a important vulnerability that lets menace actors bypass safety filters.
Tracked as CVE-2024-39929 and patched by Exim builders on Wednesday, the safety flaw impacts Exim releases as much as and together with model 4.97.1.
The vulnerability is as a result of incorrect parsing of multiline RFC2231 header filenames, which might let distant attackers ship malicious executable attachments into finish customers’ mailboxes by circumventing the $mime_filename extension-blocking safety mechanism.
“If a person have been to obtain or run one in every of these malicious information, the system could possibly be compromised,” Censys warned, including that “a PoC is out there, however no energetic exploitation is understood but.”
“As of July 10, 2024, Censys observes 1,567,109 publicly uncovered Exim servers operating a doubtlessly weak model (4.97.1 or earlier), concentrated largely in america, Russia, and Canada,” the corporate added.
Whereas e mail recipients will nonetheless have to launch the malicious attachment to be affected, the flaw permits menace actors to bypass safety checks based mostly on file extensions. This enables them to ship dangerous information which might be usually blocked, corresponding to executables, into their targets’ mailboxes.
Admins who can not instantly improve Exim are suggested to limit distant entry to their servers from the Web to dam incoming exploitation makes an attempt.
Tens of millions of servers uncovered on-line
MTA servers, corresponding to Exim, are sometimes focused in assaults as a result of they’re virtually at all times accessible through the Web, making them straightforward to seek out potential entry factors right into a goal’s community.
Exim can also be the default Debian Linux MTA and is the world’s hottest MTA software program, based mostly on a mail server survey from earlier this month.
In accordance with the survey, over 59% of the 409,255 mail servers reachable on the Web through the survey have been operating Exim, representing simply over 241,000 Exim cases.
Additionally, per a Shodan search, over 3.3 million Exim servers are at present uncovered on-line, most in america, adopted by Russia and the Netherlands. Censys discovered 6,540,044 public-facing mail servers on-line, 4,830,719 (roughly 74%) operating Exim.
​The Nationwide Safety Company (NSA) revealed in May 2020 that the infamous Russian army hacking group Sandworm has been exploiting a important CVE-2019-10149 Exim flaw (dubbed The Return of the WIZard) since not less than August 2019.
Extra lately, in October, the Exim devs patched three zero-days disclosed by Development Micro’s Zero Day Initiative (ZDI), one in every of them (CVE-2023-42115) exposing millions of Web-exposed Exim servers to pre-auth RCE assaults.
