Executive brief
Mailu is a mail server distributed as Docker images. When proxy authentication is enabled but misconfigured, attackers can spoof the X-Forwarded-By header to bypass authentication and gain unauthorized access to the mail server. This allows unauthenticated users to access email accounts and data without valid credentials.
Technical details
The vulnerability exists in the nginx proxy configuration when PROXY_AUTH_WHITELIST is set but REAL_IP_HEADER is unset. The proxy_hide_header directive hides the X-Forwarded-By header in upstream responses but fails to overwrite or validate incoming client-controlled requests, allowing header spoofing. An unauthenticated remote attacker can send a crafted X-Forwarded-By header to impersonate a trusted proxy and bypass authentication.
Affected products
- Mailu Mailu 2.0 to 2024.06.54
- Mailu helm-charts prior to 2.7.3
Timeline
- 2026-09-21: disclosed
- 2024-06-55: patched: Fixed in Mailu 2024.06.55
- 2024-07: patched: Fixed in helm-charts 2.7.3