CVE-2024-30270
Published: 04 April 2024
Summary
CVE-2024-30270 is a medium-severity Path Traversal (CWE-22) vulnerability in Mailcow Mailcow\. Its CVSS base score is 6.2 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 2.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
mailcow: dockerized, an open source groupware and email suite based on Docker, contains a path traversal and arbitrary code execution vulnerability in versions prior to 2024-04. The flaw resides in the rspamd_maps() function, where improper path validation allows overwriting of any file writable by the www-data user and is tracked as CWE-22.
An authenticated administrator can exploit the issue remotely to chain the file write into arbitrary command execution on the server. The CVSS 6.2 rating reflects the required high attack complexity and high privileges, with impacts on confidentiality, integrity, and availability.
The GitHub security advisory and the mailcow 2024-04 release notes state that the update contains a patch for the path-validation weakness. A SonarSource analysis further highlights the need to sanitize inputs that reach error-handling paths leading to the vulnerable function.
The associated EPSS score shows a current value of 0.4879 against a peak of 0.4944.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-28191
Vulnerability details
mailcow: dockerized is an open source groupware/email suite based on docker. A security vulnerability has been identified in mailcow affecting versions prior to 2024-04. This vulnerability is a combination of path traversal and arbitrary code execution, specifically targeting the `rspamd_maps()`…
more
function. It allows authenticated admin users to overwrite any file writable by the www-data user by exploiting improper path validation. The exploit chain can lead to the execution of arbitrary commands on the server. Version 2024-04 contains a patch for the issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal (CVE-2024-30270) in mailcow's admin API enables arbitrary file overwrites by authenticated admins, facilitating RCE via exploitation of a public-facing email suite application (T1190). Combined XSS (CVE-2024-31204) via unsanitized error messages enables JavaScript execution in the admin context (T1059.007) and session hijacking for further exploitation (T1539).
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.