Actively exploited in the wild
OpenSMTPD Remote Code Execution Vulnerability
OpenBSD - OpenSMTPD · Listed in the CISA KEV since 2022-03-25. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2020-7247
CriticalCVSS 9.8KEVSummary
smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the "uncommented" default configuration. The issue exists because of an incorrect return value upon failure of input validation.
Risk Assessment
An attacker can remotely execute arbitrary commands as root, taking full control of the mail server and system.
Recommendation
Update OpenSMTPD to version 6.6.1 or later, which fixes this vulnerability.
Other vulnerabilities in OpenSMTPD
Original NVD description (English source)
smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the "uncommented" default configuration. The issue exists because of an incorrect return value upon failure of input validation.