CVE-2023-2868

Classification basis

The module is a complete exploit that actively delivers a payload to achieve remote code execution. It constructs a malicious TAR file with a command-injection filename, sends it via email, and relies on the vulnerable ESG to execute the injected command.

Requirements

• Network access to the target SMTP service (port 25)modules/exploits/linux/smtp/barracuda_esg_tarfile_rce.rb:117
• A valid target email address on the ESG appliancemodules/exploits/linux/smtp/barracuda_esg_tarfile_rce.rb:75

Observed behavior

• Connects to the target SMTP server and checks the banner for Barracuda ESG identificationmodules/exploits/linux/smtp/barracuda_esg_tarfile_rce.rb:85-89
• Wraps the attacker's payload in backticks and single quotes to form a malicious filenamemodules/exploits/linux/smtp/barracuda_esg_tarfile_rce.rb:103-108
• Creates a TAR archive containing a file with the malicious filenamemodules/exploits/linux/smtp/barracuda_esg_tarfile_rce.rb:112
• Composes and sends an email with the malicious TAR attachment to the targetmodules/exploits/linux/smtp/barracuda_esg_tarfile_rce.rb:114-118

Observables

Exploit Mechanism

Payload withheldThe exploit wraps the payload in backticks and single quotes to trigger command substitution on the target.modules/exploits/linux/smtp/barracuda_esg_tarfile_rce.rb:108

Payload Delivery

Payload withheldThe module sends the exploit via SMTP to the target email address.modules/exploits/linux/smtp/barracuda_esg_tarfile_rce.rb:117-118

Method Override

Payload withheldThe module temporarily overrides a method to bypass the 100-byte filename limit for the injection payload.modules/exploits/linux/smtp/barracuda_esg_tarfile_rce.rb:129-143