CVE-2021-33515

Vulnerability

The submission service in Dovecot versions before 2.3.15 contains a STARTTLS command injection vulnerability in the lib-smtp library. When a client pipelines additional commands in plaintext after sending the STARTTLS command, those commands are executed inside the TLS session, bypassing the intended security boundary. This affects Dovecot 2.3.x installations using the submission service [1].

Exploitation

An attacker with network access to the SMTP submission port can exploit this by sending a STARTTLS command followed by pipelined SMTP commands in plaintext. The server incorrectly processes these plaintext commands as if they were within the TLS session, allowing the attacker to inject arbitrary submission commands. No authentication is required beyond the ability to initiate an SMTP connection [1].

Impact

Successful exploitation allows an attacker to intercept or redirect sensitive information, such as email content or credentials, to an attacker-controlled address. The confidentiality and integrity of data transmitted via the submission service are compromised, though the CVSS score of 4.2 indicates low overall severity [1].

Mitigation

The vulnerability is fixed in Dovecot version 2.3.15, released on June 21, 2021 [1]. Users should upgrade to this version or later. No known workarounds exist; disabling the submission service or restricting network access may reduce exposure but is not a full mitigation [1].