CVE-2020-7247
Published: 29 January 2020
Summary
CVE-2020-7247 is a critical-severity OS Command Injection (CWE-78) vulnerability in Debian Debian Linux. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.1% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-11 (Error Handling).
Deeper analysis
CVE-2020-7247 is a command injection vulnerability in the smtp_mailaddr function within smtp_session.c of OpenSMTPD 6.6, as deployed in OpenBSD 6.6 and related products. The flaw stems from an incorrect return value when input validation fails, enabling shell metacharacters supplied in a MAIL FROM field to be processed during a crafted SMTP session. It impacts the default configuration when the "uncommented" setup is in use and is tracked under CWE-78 and CWE-755 with a CVSS 3.1 base score of 9.8.
Remote unauthenticated attackers can exploit the issue over the network by establishing an SMTP session and injecting arbitrary commands that execute with root privileges, achieving full system compromise without requiring user interaction.
Public exploit code for remote code execution and local privilege escalation against affected OpenSMTPD versions has been published on PacketStorm, confirming the vulnerability's practical exploitability in default deployments.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-28374
Vulnerability details
smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects…
more
the "uncommented" default configuration. The issue exists because of an incorrect return value upon failure of input validation.
- CWE(s)
- KEV Date Added
- 25 March 2022
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of SMTP input fields (MAIL FROM) to reject metacharacters before they reach smtp_mailaddr, blocking the command-injection path.
Mandates correct error handling so that an input-validation failure in smtp_mailaddr returns a safe value instead of allowing crafted data to proceed to command execution.
Limits the OpenSMTPD process to non-root privileges, reducing the impact of successful command injection from full system compromise to a lower-privileged context.