Description
A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar file (tape archives). The vulnerability stems from incomplete input validation of a user-supplied .tar file as it pertains to the names of the files contained within the archive. As a consequence, a remote attacker can specifically format these file names in a particular manner that will result in remotely executing a system command through Perl's qx operator with the privileges of the Email Security Gateway product. This issue was fixed as part of BNSF-36456 patch. This patch was automatically applied to all customer appliances.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Barracuda | Barracuda Email Security Gateway | 5.1.3.001 – < 9.2.0.006 | 9.2.0.006 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Barracuda ESG TAR Filename Command Injection
exploit/linux/smtp/barracuda_esg_tarfile_rce
GitHub 3 repositories
-
cfielding-r7/poc-cve-2023-2868 ★ 11 · Jun 20, 2023
-
krmxd/CVE-2023-2868 ★ 0 · Aug 25, 2023
-
cashapp323232/CVE-2023-2868CVE-2023-2868 ★ 0 · Jul 30, 2023
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- WID-SEC-2023-1441 Barracuda Networks Email Security Gateway: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Jul 5, 2023