CVE-2019-10149

What is Exim?

Exim is a widely deployed open-source mail transfer agent (MTA), the software responsible for routing and delivering email on Unix-like servers. It has historically been the default MTA on many Debian-based Linux distributions and is used across a huge share of internet-facing mail servers worldwide, making any remotely exploitable, unauthenticated bug in Exim an immediate mass-exploitation target.

Overview

CVE-2019-10149, nicknamed "Return of the WIZard" by its discoverers at Qualys, is a Critical (9.8) OS command injection vulnerability (CWE-78) in Exim versions 4.87 through 4.91. Improper validation of a recipient email address in the deliver_message() function in src/deliver.c allows a remote attacker — in the default configuration, a local attacker, but in many real-world configurations involving non-default verify ACLs or address-rewriting, an unauthenticated remote attacker — to inject and execute arbitrary OS commands with root privileges. Qualys disclosed the finding in June 2019, alongside the release of Exim 4.92, and within days attackers were mass-scanning the internet for vulnerable servers.

Affected Versions

Technical Details

The bug occurs in how Exim constructs and validates the recipient address string used during local message delivery; a specially crafted recipient address can smuggle shell metacharacters into a command that Exim later executes, resulting in command injection running as root (since Exim's delivery process typically runs with elevated privileges). While the vulnerability's simplest exploitation path requires local access, several common Exim configurations — including certain ACL setups that pass externally supplied data into the vulnerable code path — expose it to unauthenticated remote exploitation over SMTP, which is what drove the rapid mass exploitation observed after disclosure.

Discovery

Discovered and disclosed by the Qualys Research Labs security team, published as a Qualys Security Advisory in June 2019 alongside the coordinated Exim 4.92 release.

Exploitation Context

CVE-2019-10149 was mass-exploited within days of public disclosure: security researchers and threat intelligence firms reported internet-wide scanning campaigns and worming botnets compromising unpatched, internet-facing Exim servers to install cryptocurrency-mining malware and, in some cases, additional backdoors. Its combination of a wormable network vector, no authentication requirement in vulnerable configurations, and Exim's massive install base made it one of the most actively exploited Linux mail-server vulnerabilities of 2019.

Remediation

1. Upgrade Exim to version 4.92 or later immediately.
2. Audit Exim ACL configurations for patterns that pass externally supplied recipient data into delivery routines, even after patching, as a defense-in-depth measure.
3. Restrict SMTP exposure to only what is operationally required, and place mail servers behind network-level filtering where possible.
4. Review server logs and running processes for signs of unauthorized cryptomining malware or backdoors if the server was unpatched and internet-facing during mid-to-late 2019.
5. Run mail services with the minimum privileges necessary and monitor for unexpected root-level process spawning from the Exim delivery process.