Curt Hyvarinen
Source-scoped identity with 2 associated PoCs and 3 linked vulnerabilities.
Exploit catalog results
Showing 2 PoCs on this page
MetasploitBarracuda ESG Spreadsheet::ParseExcel Arbitrary Code Execution
Metasploit exploitby Mandiant, plus 1 additional contributorAdded to Metasploit 2026-03-01ExploitCVE-2023-7101CVE-2023-71021 file
Analysis
Technical assessment
A Metasploit module that exploits CVE-2023-7102 in Barracuda ESG by sending an email with a malicious XLS attachment. The XLS file contains a crafted Number format string with embedded Perl code, which is executed via an unsafe eval() in Spreadsheet::ParseExcel when the ESG's Amavis scanner processes the attachment.
Backdoor review
No backdoor observed in reviewed code
The Metasploit module exploits CVE-2023-7102 by generating a malicious XLS file with a payload embedded in a FORMAT record. The payload is the user-supplied Metasploit payload, and the module's behavior is consistent with a standard exploit for the described vulnerability. No concealed, deceptive, or operator-directed harmful behavior beyond the stated exploit was observed.
Classification basis and observed behavior
Classification basis
The module is a fully functional exploit that actively delivers a malicious payload to a vulnerable target. It constructs a weaponized XLS file, packages it in an email, and sends it via SMTP to trigger remote code execution on the Barracuda ESG appliance.
modules/exploits/linux/smtp/barracuda_esg_spreadsheet_rce.rb:129-160modules/exploits/linux/smtp/barracuda_esg_spreadsheet_rce.rb:166-188Requirements
- Network access to the target Barracuda ESG SMTP port (default 25)
modules/exploits/linux/smtp/barracuda_esg_spreadsheet_rce.rb:155 - A valid target email address on the ESG appliance
modules/exploits/linux/smtp/barracuda_esg_spreadsheet_rce.rb:103 - Payload must not contain ']' or single quote characters
modules/exploits/linux/smtp/barracuda_esg_spreadsheet_rce.rb:80modules/exploits/linux/smtp/barracuda_esg_spreadsheet_rce.rb:133-138
Observed behavior
- Connects to the target SMTP server and sends an email with a dynamically generated XLS attachment
modules/exploits/linux/smtp/barracuda_esg_spreadsheet_rce.rb:152-156 - Generates a BIFF8 XLS file containing a FORMAT record with a malicious Number format string that includes a Perl system() call
modules/exploits/linux/smtp/barracuda_esg_spreadsheet_rce.rb:166-170 - Embeds the attacker's command payload into the format string, which is executed when the ESG's Amavis scanner parses the XLS file using the vulnerable Spreadsheet::ParseExcel library
modules/exploits/linux/smtp/barracuda_esg_spreadsheet_rce.rb:38-47modules/exploits/linux/smtp/barracuda_esg_spreadsheet_rce.rb:159
Behaviors behind the backdoor verdict
Observables
- Payload Injection
- Payload withheldThe module embeds the user-supplied command payload into a BIFF8 FORMAT record string, which is the documented injection point for CVE-2023-7102.
modules/exploits/linux/smtp/barracuda_esg_spreadsheet_rce.rb:170 - Exploit Mechanism
- Payload withheldThe module constructs a BIFF8 XLS file and sends it via SMTP to trigger the vulnerability in the target's Amavis scanner, matching the described exploit flow.
modules/exploits/linux/smtp/barracuda_esg_spreadsheet_rce.rb:166-188modules/exploits/linux/smtp/barracuda_esg_spreadsheet_rce.rb:451-462
What the analysis did not establish
- Analysis is based solely on the provided Ruby source code and metadata; the module was not executed, and its runtime behavior or reliability is not verified.
- The evidence does not include the contents of referenced Metasploit mixins (e.g., Msf::Exploit::Remote::SMTPDeliver, Rex::OLE), so the full implementation of email delivery and OLE2 generation is not visible.
- The evidence does not include the actual Spreadsheet::ParseExcel library source code, so the exact vulnerable eval() location is not confirmed from the supplied files.
- Only the module source code was reviewed; Metasploit framework mixins, libraries, and external payloads were not expanded or analyzed.
- Binary files were flagged as metadata-only and not inspected, but no binary files were present in the evidence.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
MetasploitBarracuda ESG TAR Filename Command Injection
Metasploit exploitby Mandiant, plus 1 additional contributorAdded to Metasploit 2026-02-28ExploitCVE-2023-28681 file
Analysis
Technical assessment
A Metasploit module that exploits CVE-2023-2868, a command injection vulnerability in Barracuda Email Security Gateway. It sends an email with a specially crafted TAR attachment whose filename contains backtick-wrapped shell commands, achieving remote code execution when the ESG processes the attachment.
Backdoor review
No backdoor observed in reviewed code
The module is a standard Metasploit exploit for CVE-2023-2868. It constructs a TAR file with a malicious filename containing backtick-wrapped payload commands and delivers it via SMTP. No concealed backdoor, deceptive payload, or operator-directed harm was observed. The code performs only the documented exploit behavior.
Classification basis and observed behavior
Classification basis
The module is a complete exploit that actively delivers a payload to achieve remote code execution. It constructs a malicious TAR file with a command-injection filename, sends it via email, and relies on the vulnerable ESG to execute the injected command.
modules/exploits/linux/smtp/barracuda_esg_tarfile_rce.rb:16-26modules/exploits/linux/smtp/barracuda_esg_tarfile_rce.rb:102-121Requirements
- Network access to the target SMTP service (port 25)
modules/exploits/linux/smtp/barracuda_esg_tarfile_rce.rb:117 - A valid target email address on the ESG appliance
modules/exploits/linux/smtp/barracuda_esg_tarfile_rce.rb:75
Observed behavior
- Connects to the target SMTP server and checks the banner for Barracuda ESG identification
modules/exploits/linux/smtp/barracuda_esg_tarfile_rce.rb:85-89 - Wraps the attacker's payload in backticks and single quotes to form a malicious filename
modules/exploits/linux/smtp/barracuda_esg_tarfile_rce.rb:103-108 - Creates a TAR archive containing a file with the malicious filename
modules/exploits/linux/smtp/barracuda_esg_tarfile_rce.rb:112 - Composes and sends an email with the malicious TAR attachment to the target
modules/exploits/linux/smtp/barracuda_esg_tarfile_rce.rb:114-118
Behaviors behind the backdoor verdict
Observables
- Exploit Mechanism
- Payload withheldThe exploit wraps the payload in backticks and single quotes to trigger command substitution on the target.
modules/exploits/linux/smtp/barracuda_esg_tarfile_rce.rb:108 - Payload Delivery
- Payload withheldThe module sends the exploit via SMTP to the target email address.
modules/exploits/linux/smtp/barracuda_esg_tarfile_rce.rb:117-118 - Method Override
- Payload withheldThe module temporarily overrides a method to bypass the 100-byte filename limit for the injection payload.
modules/exploits/linux/smtp/barracuda_esg_tarfile_rce.rb:129-143
What the analysis did not establish
- Analysis is based solely on the module source code and metadata; framework mixins, libraries, and external payloads are not expanded.
- The module's actual runtime behavior, reliability, and safety are not verified.
- Only the module source and metadata were reviewed; framework mixins, libraries, and external payloads were not expanded or analyzed.
- Binary files were not inspected (metadata only).
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.