Wiz Defend is Here: Threat detection and response for cloud

Critical and high severity Exim vulnerabilities: everything you need to know

Detect and mitigate CVE-2023-42115, and 5 more vulnerabilities in Exim. Organizations using affected configurations should mitigate and patch the vulnerabilities urgently.

2 minutes read

Multiple vulnerabilities were publicly disclosed by the Zero Day Initiative (ZDI) in Exim Mail Transfer Agent (MTA), including CVE-2023-42115, which is a critical vulnerability enabling unauthenticated attackers to remotely execute code on publicly exposed Exim servers with “External” authentication enabled. This issue results from improper input validation that leads to writing arbitrary code past the end of the buffer. The recommendation is to update Exim to patched versions, or if not possible, restrict remote access to Exim mail servers if you have “External” authentication enabled, or to switch to a different authentication method. 

What is CVE-2023-42115? 

Exim is a very prevalent mail server, due in part to being the default MTA preinstalled on Debian and other Linux distributions. According to the recently published Mail Server Survey, Exim is the world’s most popular MTA software. As MTA servers are often accessible via the Internet, they are likely to serve as an initial access vector for attackers. 

CVE-2023-42115 allows unauthenticated remote attackers to execute arbitrary code on affected installations of Exim, which runs over the SMTP service – exposed on port 25 by default, though ports 26, 587 and 465 are also commonly used. This issue results from improper input validation that leads to an out-of-bounds write found in the SMTP service when “External” authentication is enabled. This results in a write past the end of the buffer. A successful exploitation of this vulnerability could lead to an attacker executing code in the context of the service account. 

Since disclosure, security researchers have been exploring Exim’s source code to find the relevant vulnerabilities, with some claiming success. Therefore, we expect exploitation in the wild to be observed shortly. 

Besides CVE-2023-42115 which is critical, CVE-2023-42116, CVE-2023-42117 and CVE-2023-42118 are high severity vulnerabilities that also allow remote code execution under certain conditions, while CVE-2023-42114 and CVE-2023-42119 are low severity and only allow limited information disclosure. In all cases, these vulnerabilities require specific features to be enabled in order to be exploitable. 

CVECVSSRequirements for exploitation
CVE-2023-421159.8“External” authentication scheme configured and available
CVE-2023-421168.1“SPA” module (used for NTLM auth) configured and available
CVE-2023-421178.1Exim Proxy (different to a SOCKS or HTTP proxy) in use with untrusted proxy server
CVE-2023-421187.5“SPF” condition used in an ACL
CVE-2023-421143.7“SPA” module (used for NTLM auth) configured to authenticate the Exim server to an upstream server
CVE-2023-421193.1An untrusted DNS resolver

Wiz Research data: what’s the risk to cloud environments?       

According to Wiz data, 23% percent of cloud environments have at least one instance of Exim, but we estimate that less than 5% of environments have publicly exposed Exim servers that might be at risk of exploitation.  

Which products are affected? 

Not all of the vulnerabilities have received patches yet. 

CVEPatched versionWorkaround
CVE-2023-42114Fixed in versions 4.96.1 and 4.97.Disable SPA (NTLM) authentication
CVE-2023-42115Fixed in versions 4.96.1 and 4.97.Disable EXTERNAL authentication.
CVE-2023-42116Fixed in versions 4.96.1 and 4.97.Do not use SPA (NTLM) authentication
CVE-2023-42117No fix available – all versions are assumed to be affectedDo not use Exim behind an untrusted proxy-protocol proxy
CVE-2023-42118No fix available – all versions are assumed to be affectedDo not use the spf condition in your ACL
CVE-2023-42219No fix available – all versions are assumed to be affectedUse a trustworthy DNS resolver which is able to validate the data according to the DNS record types.

Which actions should security teams take? 

Organizations should upgrade Exim instances to a patched version or apply the workarounds listed above. If you are confident that you aren’t using any of the features required for exploitation, you can deprioritize patching for now. 

To determine whether you’re using “External” authentication, run the following command to locate your configuration file. If it includes driver = external, you should consider switching to a different authentication method or limiting remote access to the server altogether: 

exim4 -bP configure_file 

 Wiz customers can use the pre-built query and advisory in the Wiz Threat Center to search for all vulnerable instances in their environment, or limit results to instances publicly exposed on common SMTP ports. 

References 

Continue reading

Get a personalized demo

Ready to see Wiz in action?

“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management