CVE-2023-7102

CRITICAL

Remote Code Execution (RCE) Vulnerability

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2023-7102 has a selected CVSS score of 9.8 (critical); EIP currently links 1 catalogued exploit.

Description

Use of a Third Party library produced a vulnerability in Barracuda Networks Inc. Barracuda ESG Appliance which allowed Parameter Injection.This issue affected Barracuda ESG Appliance, from 5.1.3.001 through 9.2.1.001, until Barracuda removed the vulnerable logic.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Dec 24, 2023 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Catalogued exploits
1

Affected products and versions

2
ProductSourceVersion range

Email Security Gateway (ESG) Appliance

Browse Barracuda Networks / Email Security Gateway (ESG) Appliance
VulnCheckVersion data not supplied

Barracuda ESG Appliance

Browse Barracuda Networks Inc. / Barracuda ESG Appliance

Default status: unaffected

CVE List5.1.3.001 to ≤ 9.2.1.001affected

Proofs of concept

1

Catalogued exploits

MetasploitBarracuda ESG Spreadsheet::ParseExcel Arbitrary Code ExecutionMetasploit exploitby Curt Hyvarinen +2 moreExploit1 file

Ruby · linked to 2 vulnerabilities

Metasploit
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Metasploit module that exploits CVE-2023-7102 in Barracuda ESG by sending an email with a malicious XLS attachment. The XLS file contains a crafted Number format string with embedded Perl code, which is executed via an unsafe eval() in Spreadsheet::ParseExcel when the ESG's Amavis scanner processes the attachment.

Backdoor review

No backdoor observed in reviewed code

The Metasploit module exploits CVE-2023-7102 by generating a malicious XLS file with a payload embedded in a FORMAT record. The payload is the user-supplied Metasploit payload, and the module's behavior is consistent with a standard exploit for the described vulnerability. No concealed, deceptive, or operator-directed harmful behavior beyond the stated exploit was observed.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesRuby
Target softwareBarracuda Email Security GatewaySpreadsheet::ParseExcel
Attack typesRemote Code ExecutionEval Injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The module is a fully functional exploit that actively delivers a malicious payload to a vulnerable target. It constructs a weaponized XLS file, packages it in an email, and sends it via SMTP to trigger remote code execution on the Barracuda ESG appliance.

modules/exploits/linux/smtp/barracuda_esg_spreadsheet_rce.rb:129-160modules/exploits/linux/smtp/barracuda_esg_spreadsheet_rce.rb:166-188

Requirements

  • Network access to the target Barracuda ESG SMTP port (default 25)modules/exploits/linux/smtp/barracuda_esg_spreadsheet_rce.rb:155
  • A valid target email address on the ESG appliancemodules/exploits/linux/smtp/barracuda_esg_spreadsheet_rce.rb:103
  • Payload must not contain ']' or single quote charactersmodules/exploits/linux/smtp/barracuda_esg_spreadsheet_rce.rb:80modules/exploits/linux/smtp/barracuda_esg_spreadsheet_rce.rb:133-138

Observed behavior

  • Connects to the target SMTP server and sends an email with a dynamically generated XLS attachmentmodules/exploits/linux/smtp/barracuda_esg_spreadsheet_rce.rb:152-156
  • Generates a BIFF8 XLS file containing a FORMAT record with a malicious Number format string that includes a Perl system() callmodules/exploits/linux/smtp/barracuda_esg_spreadsheet_rce.rb:166-170
  • Embeds the attacker's command payload into the format string, which is executed when the ESG's Amavis scanner parses the XLS file using the vulnerable Spreadsheet::ParseExcel librarymodules/exploits/linux/smtp/barracuda_esg_spreadsheet_rce.rb:38-47modules/exploits/linux/smtp/barracuda_esg_spreadsheet_rce.rb:159
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Payload Injection
Payload withheldThe module embeds the user-supplied command payload into a BIFF8 FORMAT record string, which is the documented injection point for CVE-2023-7102.modules/exploits/linux/smtp/barracuda_esg_spreadsheet_rce.rb:170
Exploit Mechanism
Payload withheldThe module constructs a BIFF8 XLS file and sends it via SMTP to trigger the vulnerability in the target's Amavis scanner, matching the described exploit flow.modules/exploits/linux/smtp/barracuda_esg_spreadsheet_rce.rb:166-188modules/exploits/linux/smtp/barracuda_esg_spreadsheet_rce.rb:451-462
Review boundaries

What the analysis did not establish

  • Analysis is based solely on the provided Ruby source code and metadata; the module was not executed, and its runtime behavior or reliability is not verified.
  • The evidence does not include the contents of referenced Metasploit mixins (e.g., Msf::Exploit::Remote::SMTPDeliver, Rex::OLE), so the full implementation of email delivery and OLE2 generation is not visible.
  • The evidence does not include the actual Spreadsheet::ParseExcel library source code, so the exact vulnerable eval() location is not confirmed from the supplied files.
  • Only the module source code was reviewed; Metasploit framework mixins, libraries, and external payloads were not expanded or analyzed.
  • Binary files were flagged as metadata-only and not inspected, but no binary files were present in the evidence.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

7