CVE-2020-7247
OpenSMTPD Remote Code Execution Vulnerability
Description
CVE-2020-7247 is a critical remote code execution vulnerability in OpenBSD's OpenSMTPD mail server that allows an unauthenticated attacker to execute arbitrary commands as root via a malformed SMTP session. The vulnerability exists in the smtp_mailaddr function, which improperly validates sender addresses, enabling command injection through the mail from envelope. CISA has added CVE-2020-7247 to the Known Exploited Vulnerabilities catalog due to confirmed active exploitation. With an EPSS score of 94.1% (99.9th percentile), this vulnerability poses an immediate, critical threat to any system running vulnerable versions of OpenSMTPD.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| openbsd | opensmtpd | 6.6 |
| debian | debian linux | 9.0; 10.0 |
| fedoraproject | fedora | 32 |
| canonical | ubuntu linux | 18.04; 19.10 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/156137/OpenBSD-OpenSMTPD-Privilege-Escalation-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/156145/OpenSMTPD-6.6.2-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/156249/OpenSMTPD-MAIL-FROM-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/156295/OpenSMTPD-6.6.1-Local-Privilege-Escalation.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/162093/OpenBSD-OpenSMTPD-6.6-Remote-Code-Execution.html(Broken Link, Third Party Advisory, VDB Entry)
- http://seclists.org/fulldisclosure/2020/Jan/49(Exploit, Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2020/01/28/3(Exploit, Mailing List, Third Party Advisory)
- https://github.com/openbsd/src/commit/9dcfda045474d8903224d175907bfc29761dcb45(Patch)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPH4QU4DNVHA7ACFXMYFCEP5PSXXPN4E/(Mailing List, Third Party Advisory)
- https://seclists.org/bugtraq/2020/Jan/51(Mailing List, Third Party Advisory)
- https://usn.ubuntu.com/4268-1/(Third Party Advisory)
- https://www.debian.org/security/2020/dsa-4611(Mailing List, Third Party Advisory)
- https://www.kb.cert.org/vuls/id/390745(Third Party Advisory, US Government Resource)
- https://www.openbsd.org/security.html(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-7247(US Government Resource)
Weakness Type
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-78 describes a weakness where software constructs operating system commands using externally-influenced input without properly neutralizing special elements that could modify the intended command. In CVE-2020-7247, OpenSMTPD fails to properly validate the sender address in SMTP envelope commands, allowing an attacker to inject shell commands that are executed with root privileges when the mail delivery process handles the malformed message.
Learn more: CWE-78 — OS Command Injection
Impact Analysis
CVE-2020-7247 enables unauthenticated remote code execution with root privileges on affected OpenSMTPD installations, representing the maximum possible impact. The vulnerability is exploitable from the network without any authentication or user interaction, as it requires only a standard SMTP connection to the mail server. An attacker achieving root access through this flaw can fully compromise the server, exfiltrate all email data, install persistent backdoors, pivot to other systems on the network, and intercept or manipulate all email communications passing through the server. Since mail servers are often internet-facing by design and handle sensitive communications, the potential for data breach and organizational compromise is exceptionally high. The EPSS score of 94.1% (99.9th percentile) confirms this vulnerability is under widespread active exploitation.
Exploit Maturity
CVE-2020-7247 is actively exploited in the wild, as confirmed by its inclusion in the CISA Known Exploited Vulnerabilities catalog. Public exploit code and detailed technical write-ups are widely available, including a Qualys advisory that provides a comprehensive analysis of the exploitation technique. The EPSS score of 94.1% (99.9th percentile) reflects near-certain exploitation probability. The exploit is particularly dangerous because it requires only a basic SMTP connection, making it trivially automatable by scanning tools and botnets.
Remediation
- Upgrade OpenSMTPD to version 6.6.2p1 or later immediately, as this version contains the security fix for CVE-2020-7247. Apply patches per vendor instructions as required by the CISA KEV directive.
- If immediate patching is not possible, implement network-level restrictions to limit SMTP access to the vulnerable server from trusted sources only, using firewall rules to block untrusted inbound connections on port 25.
- Review mail server logs for suspicious SMTP sessions containing unusual sender addresses with shell metacharacters, which may indicate exploitation attempts or successful compromise.
- After patching, audit the system for indicators of compromise including unauthorized user accounts, unexpected cron jobs, modified system binaries, and suspicious outbound network connections.
- Implement defense-in-depth measures by running the mail server in a sandboxed environment, applying principle of least privilege, and deploying network intrusion detection to monitor SMTP traffic for exploitation patterns.
Technical Details
CVE-2020-7247 is an OS command injection vulnerability (CWE-78) in the smtp_mailaddr function of OpenSMTPD, the default mail transfer agent in OpenBSD. The flaw exists in how the SMTP daemon processes the MAIL FROM envelope command during an SMTP session. When a specially crafted sender address containing shell metacharacters is submitted, the smtp_mailaddr function fails to properly validate and sanitize the input before passing it to the mail delivery agent, which executes it in a shell context with root privileges. The exploit can be triggered through a standard SMTP conversation without any authentication, requiring only that the attacker can connect to the SMTP port (25) of the affected server. OpenSMTPD versions prior to 6.6.2p1 are affected, and since OpenSMTPD is the default MTA on OpenBSD, all default OpenBSD installations with SMTP enabled are vulnerable.
Frequently Asked Questions
Is CVE-2020-7247 being actively exploited?
Yes, CVE-2020-7247 is actively exploited in the wild and is listed in the CISA Known Exploited Vulnerabilities catalog. Public exploit code is freely available, and the EPSS score of 94.1% (99.9th percentile) confirms extremely high exploitation activity. Any internet-facing OpenSMTPD instance running a vulnerable version should be considered at immediate risk.
What products are affected by CVE-2020-7247?
CVE-2020-7247 affects OpenBSD OpenSMTPD versions prior to 6.6.2p1. Since OpenSMTPD is the default mail transfer agent on OpenBSD, all OpenBSD systems with SMTP service enabled are potentially vulnerable. OpenSMTPD is also available as a portable version for other Unix-like operating systems, and those installations are equally affected.
How do I fix CVE-2020-7247?
Upgrade OpenSMTPD to version 6.6.2p1 or later, which contains the fix for this vulnerability. On OpenBSD, apply the latest system patches. If using the portable version, update to the patched release. If immediate patching is not possible, restrict network access to the SMTP port to trusted sources only.
How severe is CVE-2020-7247?
CVE-2020-7247 is rated CRITICAL as it enables unauthenticated remote code execution with root privileges via a simple SMTP connection. The EPSS score of 94.1% (99.9th percentile) indicates near-certain exploitation. The combination of root-level access, no authentication requirement, and the internet-facing nature of mail servers makes this one of the most dangerous mail server vulnerabilities.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.