Executive brief
Haraka is an open-source Node.js-based email server. A critical command injection vulnerability in its zip file attachment processing plugin allows unauthenticated remote attackers to execute arbitrary commands with the privileges of the email server process, potentially compromising the entire server and any data it handles.
Technical details
The vulnerability is a command injection flaw (CWE-77) in Haraka versions 2.8.8 and earlier, specifically in the zip attachment processing plugin. The plugin fails to properly sanitize user-controlled input from email attachments before passing it to a system command execution function. An attacker can send a malicious email with a specially crafted zip file attachment to trigger command injection. No authentication is required, and the attack is network-accessible. Successful exploitation allows remote code execution with the privileges of the Haraka mail server process. The vulnerability was fixed in version 2.8.9.
Affected products
- Haraka Project Haraka before 2.8.9
Timeline
- 2019-02-12: disclosed
- 2016: patched: CVE-2016-1000282 published; fix released in Haraka 2.8.9