CVE-2020-12713

Vulnerability

CipherMail Community Gateway and Professional/Enterprise Gateway versions 1.0.1 through 4.7.1-0, and CipherMail Webmail Messenger versions 1.1.1 through 3.1.1-0, include a web interface page that allows an administrator to edit the raw Postfix main.cf configuration file [4]. The software does not restrict which settings can be modified, enabling the injection of Postfix directives that execute arbitrary commands when the service reloads [4].

Exploitation

An attacker must have administrative access to the CipherMail web interface [1]. With that access, they can navigate to the MTA configuration page and edit the Postfix main.cf file, adding directives that cause Postfix to run shell commands as root upon reloading the configuration [4]. No additional authentication or user interaction beyond the initial admin login is required.

Impact

Successful exploitation elevates the attacker's privileges from web-interface administrator to the Unix root account, granting full control over the underlying operating system [4]. This includes the ability to read, modify, or delete any file, install persistent backdoors, and compromise all data processed by the email gateway [4].

Mitigation

CipherMail released a fix that adds an allowed_settings variable to the configuration script, restricting changes to a whitelist of safe Postfix settings [4]. Users should upgrade to a version that includes this fix (the fixed versions are later than 4.7.1-0 for the Gateway and later than 3.1.1-0 for Webmail Messenger) [4]. No workaround is provided for unpatched installations; access to the web interface should be strictly limited to trusted administrators until an upgrade can be performed.