CVE-2023-42115
CRITICALExim < 4.96.1 - Unauthenticated Remote Code Execution via SMTP Service Buffer Overflow
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2023-42115. PoCs published by kirinse, doaso.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2023-42115, targeting Exim SMTP servers. The exploit includes a scanner mode to check for vulnerability and an exploit mode to execute a reverse shell payload. The payload generator script creates reverse shells for Linux or Windows.
Description
Exim AUTH Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Exim. Authentication is not required to exploit this vulnerability. The specific flaw exists within the smtp service, which listens on TCP port 25 by default. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of a buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. . Was ZDI-CAN-17434.
Exploits (3)
This repository contains a functional exploit for CVE-2023-42115, targeting Exim SMTP servers. The exploit includes a scanner mode to check for vulnerability and an exploit mode to execute a reverse shell payload. The payload generator script creates reverse shells for Linux or Windows.
This repository contains a functional exploit for CVE-2023-42115, an Exim AUTH Out-Of-Bounds Write Remote Code Execution Vulnerability. The exploit sends a crafted MAIL FROM command to trigger a reverse shell via UDP, demonstrating arbitrary code execution without authentication.
This repository contains functional exploit code for CVE-2023-42115, targeting Exim SMTP servers. The exploit leverages command injection via the MAIL FROM field to achieve remote code execution (RCE).
References (1)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H