CVE-2024-39929
MEDIUMExim < 4.97.1 - Improper Encoding or Escaping of Output via Multiline RFC 2231 Header Filename
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2024-39929. PoCs published by michael-david-fry, rxerium.
AI-analyzed exploit summary The repository contains a functional Python script that exploits CVE-2024-39929 in Exim by sending a crafted email with a malformed attachment filename to bypass file extension blocking mechanisms. The PoC demonstrates the vulnerability by leveraging SMTP to deliver potentially executable attachments.
Description
Exim through 4.97.1 misparses a multiline RFC 2231 header filename, and thus remote attackers can bypass a $mime_filename extension-blocking protection mechanism, and potentially deliver executable attachments to the mailboxes of end users.
Exploits (2)
The repository contains a functional Python script that exploits CVE-2024-39929 in Exim by sending a crafted email with a malformed attachment filename to bypass file extension blocking mechanisms. The PoC demonstrates the vulnerability by leveraging SMTP to deliver potentially executable attachments.
This repository contains a Nuclei template for detecting vulnerable Exim versions (up to 4.97.1) affected by CVE-2024-39929, which involves bypassing MIME filename extension blocking via multiline RFC 2231 header parsing. The template scans for Exim version banners but does not include exploit code.
References (5)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N