CVE-2020-7247

What is OpenSMTPD?

OpenSMTPD is the mail transfer agent (MTA) that ships by default with OpenBSD and is also packaged for use on Linux and other Unix-like systems as a lighter-weight alternative to Sendmail or Postfix. As an MTA, it runs with elevated privileges (typically root, to bind privileged ports and manage mail delivery) and, by definition, accepts network input from arbitrary remote senders — any host on the internet that can send it an email can interact with it.

Overview

CVE-2020-7247 is a remote code execution vulnerability discovered by Qualys' security research team in the smtp_mailaddr() function within smtp_session.c. A crafted SMTP session containing a malformed sender address causes an out-of-bounds read that, when combined with how OpenSMTPD constructs its internal delivery command, allows a remote, unauthenticated attacker to execute arbitrary shell commands as root (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8 Critical). Qualys reported the flaw and OpenBSD shipped a fix the same day the advisory went public.

Technical Details

The bug (CWE-78, OS command injection) arises from insufficient validation of the sender address field during SMTP session processing: a specially crafted address containing shell-significant characters can be smuggled through into a context where it's ultimately interpreted as part of a command line, rather than treated purely as address data. Because OpenSMTPD typically runs as root to manage local mail delivery, successful exploitation gives an attacker root-level code execution with a single crafted SMTP session and no authentication.

Discovery

Discovered and responsibly disclosed by Qualys' security research team, published via the oss-security mailing list on January 28, 2020, with OpenBSD's fix released the same day.

Exploitation Context

Because the exploitation primitive is simple (a single crafted SMTP conversation) and OpenSMTPD instances are, by their nature, directly internet-reachable mail servers, mass scanning and exploitation attempts began within roughly 24 hours of public disclosure — among the fastest weaponization timelines of any vulnerability in this era, comparable to the speed later documented for Adobe ColdFusion and other internet-facing services in our time-to-exploitation analysis.

Remediation

1. Update OpenSMTPD to the patched version immediately — the fix shipped the same day as the advisory, so any unpatched instance has had years to remediate.
2. Restrict SMTP port exposure to only what's operationally necessary; an OpenSMTPD instance that doesn't need to receive mail from arbitrary internet senders should not have port 25 open to the world.
3. Run mail services with the minimum privilege necessary where the MTA's architecture allows it, to limit the blast radius of any future similar vulnerability.
4. Review mail server logs for anomalous SMTP sessions around the January 2020 disclosure window on any instance that was unpatched and internet-facing at the time, given how quickly mass exploitation began.