CVE-2023-2868
Barracuda Networks ESG Appliance Improper Input Validation Vulnerability
Description
CVE-2023-2868 is a critical remote command injection vulnerability in the Barracuda Email Security Gateway (ESG) appliance affecting versions 5.1.3.001 through 9.2.0.006. The flaw arises from incomplete input validation of .tar file archives, where specially crafted filenames within an archive can trigger arbitrary command execution through Perl's qx operator. An unauthenticated remote attacker can exploit this vulnerability to execute system commands with the privileges of the ESG product. With a CVSS score of 9.4 and an EPSS score of 89.5% (99th percentile), CVE-2023-2868 has been confirmed by CISA as actively exploited and was the subject of a significant espionage campaign.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:LOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| barracuda | email security gateway 300 firmware | >= 5.1.3.001, <= 9.2.0.006 |
| barracuda | email security gateway 400 firmware | >= 5.1.3.001, <= 9.2.0.006 |
| barracuda | email security gateway 600 firmware | >= 5.1.3.001, <= 9.2.0.006 |
| barracuda | email security gateway 800 firmware | >= 5.1.3.001, <= 9.2.0.006 |
| barracuda | email security gateway 900 firmware | >= 5.1.3.001, <= 9.2.0.006 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://status.barracuda.com/incidents/34kx82j5n4q9(Vendor Advisory)
- https://www.barracuda.com/company/legal/esg-vulnerability(Mitigation, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-2868(US Government Resource)
Weakness Type
CWE-20: Improper Input Validation
In the context of CVE-2023-2868, the Barracuda Email Security Gateway fails to comprehensively validate filenames within user-supplied .tar archives before processing them. This improper input validation allows specially formatted filenames to pass through to command execution contexts without adequate sanitization.
Learn more: CWE-20 — Improper Input Validation
CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
The incomplete sanitization of .tar filenames in the Barracuda ESG allows attacker-controlled input to reach Perl's qx operator, which executes the content as a system command. This command injection weakness enables remote code execution with the privileges of the email gateway process.
Learn more: CWE-77 — Improper Neutralization of Special Elements used in a Command
Impact Analysis
CVE-2023-2868 carries a CVSS v3.1 score of 9.4 (Critical), reflecting its severe impact on enterprise email security infrastructure. The vulnerability is remotely exploitable without physical access through the network, with low attack complexity requiring no special conditions. No authentication is required and no user interaction is needed, as the malicious .tar archive is processed automatically by the email gateway. Confidentiality and integrity impacts are High, meaning attackers can read sensitive email data and install persistent backdoors, while availability impact is rated Low. The EPSS score of 89.5% places CVE-2023-2868 in the 99th percentile, indicating extremely high exploitation probability. As an email security gateway, a compromised Barracuda ESG provides attackers with access to all email traffic flowing through the appliance, making it an exceptionally high-value target for espionage operations.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2023-2868 in the wild by adding it to the Known Exploited Vulnerabilities catalog, with a remediation deadline of June 16, 2023. This vulnerability was notably exploited in a sustained espionage campaign attributed to advanced threat actors, who leveraged the command injection flaw to deploy persistent backdoors on Barracuda ESG appliances. The EPSS score of 89.5% indicates near-certain exploitation activity, placing it in the 99th percentile of all scored vulnerabilities. The severity of the exploitation led Barracuda to take the extraordinary step of recommending that affected appliances be completely replaced rather than merely patched, underscoring the depth of compromise achievable through this vulnerability.
Remediation
- Replace affected appliances as recommended by Barracuda and CISA's KEV required action. Due to the severity and persistence of exploitation, Barracuda has advised that affected ESG appliances should be decommissioned and replaced, even if the BNSF-36456 patch has been applied. Contact Barracuda support for replacement guidance.
- Verify patch application status — the BNSF-36456 patch was automatically deployed to all customer appliances. Confirm through the Barracuda management interface that the patch was successfully applied to your ESG appliances (versions 5.1.3.001 through 9.2.0.006).
- Conduct a thorough compromise assessment by reviewing ESG logs for indicators of compromise, including unauthorized file modifications, unexpected outbound network connections, and the presence of backdoor scripts. Check for persistent access mechanisms that may survive patching.
- Rotate all credentials that the ESG appliance had access to, including email accounts, LDAP/Active Directory credentials, and any API keys or certificates stored on or accessible through the appliance.
- Implement enhanced email security monitoring by deploying additional email inspection layers and network monitoring around the ESG appliance to detect any residual or new exploitation attempts. Validate that all .tar file processing includes comprehensive input sanitization.
Technical Details
CVE-2023-2868 exploits two related weaknesses: improper input validation (CWE-20) and command injection (CWE-77) in the Barracuda Email Security Gateway's .tar file processing pipeline. The vulnerability stems from the ESG's failure to comprehensively sanitize filenames contained within .tar archives submitted to the appliance. When the gateway processes an incoming email with a .tar attachment, the filenames within the archive are extracted and passed to Perl's qx operator without adequate validation, enabling specially formatted filenames to inject arbitrary system commands. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) confirms that the attack is network-accessible, requires no authentication or user interaction, and has low complexity — an attacker simply sends an email with a crafted .tar attachment to any address handled by the vulnerable ESG. The command execution occurs with the privileges of the ESG process, providing substantial access to the appliance's operating system and all email data flowing through it.
Frequently Asked Questions
Is CVE-2023-2868 being actively exploited?
Yes, CVE-2023-2868 has been actively exploited in the wild and was the subject of a major espionage campaign. CISA added this vulnerability to its Known Exploited Vulnerabilities catalog with a remediation deadline of June 16, 2023. The EPSS score of 89.5% (99th percentile) confirms widespread exploitation activity targeting Barracuda ESG appliances.
What products are affected by CVE-2023-2868?
CVE-2023-2868 affects Barracuda Email Security Gateway appliance form factor models including ESG 300, 400, 600, 800, and 900, running firmware versions 5.1.3.001 through 9.2.0.006. Virtual and cloud-hosted deployments are not affected — only physical appliance installations are vulnerable.
How do I fix CVE-2023-2868?
Barracuda recommends replacing affected ESG appliances entirely, even if the automatic BNSF-36456 patch has been applied. Contact Barracuda support for replacement instructions. Additionally, conduct a full compromise assessment, review logs for indicators of compromise, and rotate all credentials accessible through the appliance.
How severe is CVE-2023-2868?
CVE-2023-2868 is rated Critical with a CVSS v3.1 score of 9.4 out of 10. It requires no authentication and no user interaction, and can be exploited remotely with low complexity by sending a crafted email. The EPSS percentile of 99.5% places it among the most actively exploited vulnerabilities tracked.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.