haile01

Metasploit · Author

Source-scoped identity with 1 associated PoC and 2 linked vulnerabilities.

Showing 1 PoC on this page

Metasploit

Barracuda ESG Spreadsheet::ParseExcel Arbitrary Code Execution

Metasploit exploitby Curt HyvarinenAdded to Metasploit 2026-03-01ExploitCVE-2023-7101CVE-2023-71021 file

exploit_linux/smtp/barracuda_esg_spreadsheet_rce · Ruby

MetasploitPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Metasploit module that exploits CVE-2023-7102 in Barracuda ESG by sending an email with a malicious XLS attachment. The XLS file contains a crafted Number format string with embedded Perl code, which is executed via an unsafe eval() in Spreadsheet::ParseExcel when the ESG's Amavis scanner processes the attachment.

Backdoor review

No backdoor observed in reviewed code

The Metasploit module exploits CVE-2023-7102 by generating a malicious XLS file with a payload embedded in a FORMAT record. The payload is the user-supplied Metasploit payload, and the module's behavior is consistent with a standard exploit for the described vulnerability. No concealed, deceptive, or operator-directed harmful behavior beyond the stated exploit was observed.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesRuby
Target softwareBarracuda Email Security GatewaySpreadsheet::ParseExcel
Attack typesRemote Code ExecutionEval Injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The module is a fully functional exploit that actively delivers a malicious payload to a vulnerable target. It constructs a weaponized XLS file, packages it in an email, and sends it via SMTP to trigger remote code execution on the Barracuda ESG appliance.

modules/exploits/linux/smtp/barracuda_esg_spreadsheet_rce.rb:129-160modules/exploits/linux/smtp/barracuda_esg_spreadsheet_rce.rb:166-188

Requirements

  • Network access to the target Barracuda ESG SMTP port (default 25)modules/exploits/linux/smtp/barracuda_esg_spreadsheet_rce.rb:155
  • A valid target email address on the ESG appliancemodules/exploits/linux/smtp/barracuda_esg_spreadsheet_rce.rb:103
  • Payload must not contain ']' or single quote charactersmodules/exploits/linux/smtp/barracuda_esg_spreadsheet_rce.rb:80modules/exploits/linux/smtp/barracuda_esg_spreadsheet_rce.rb:133-138

Observed behavior

  • Connects to the target SMTP server and sends an email with a dynamically generated XLS attachmentmodules/exploits/linux/smtp/barracuda_esg_spreadsheet_rce.rb:152-156
  • Generates a BIFF8 XLS file containing a FORMAT record with a malicious Number format string that includes a Perl system() callmodules/exploits/linux/smtp/barracuda_esg_spreadsheet_rce.rb:166-170
  • Embeds the attacker's command payload into the format string, which is executed when the ESG's Amavis scanner parses the XLS file using the vulnerable Spreadsheet::ParseExcel librarymodules/exploits/linux/smtp/barracuda_esg_spreadsheet_rce.rb:38-47modules/exploits/linux/smtp/barracuda_esg_spreadsheet_rce.rb:159
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Payload Injection
Payload withheldThe module embeds the user-supplied command payload into a BIFF8 FORMAT record string, which is the documented injection point for CVE-2023-7102.modules/exploits/linux/smtp/barracuda_esg_spreadsheet_rce.rb:170
Exploit Mechanism
Payload withheldThe module constructs a BIFF8 XLS file and sends it via SMTP to trigger the vulnerability in the target's Amavis scanner, matching the described exploit flow.modules/exploits/linux/smtp/barracuda_esg_spreadsheet_rce.rb:166-188modules/exploits/linux/smtp/barracuda_esg_spreadsheet_rce.rb:451-462
Review boundaries

What the analysis did not establish

  • Analysis is based solely on the provided Ruby source code and metadata; the module was not executed, and its runtime behavior or reliability is not verified.
  • The evidence does not include the contents of referenced Metasploit mixins (e.g., Msf::Exploit::Remote::SMTPDeliver, Rex::OLE), so the full implementation of email delivery and OLE2 generation is not visible.
  • The evidence does not include the actual Spreadsheet::ParseExcel library source code, so the exact vulnerable eval() location is not confirmed from the supplied files.
  • Only the module source code was reviewed; Metasploit framework mixins, libraries, and external payloads were not expanded or analyzed.
  • Binary files were flagged as metadata-only and not inspected, but no binary files were present in the evidence.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.