CVE-2020-12713: 
NixOS vulnerability analysis and mitigation

CVE-2020-12713 affects CipherMail Community Gateway and Professional/Enterprise Gateway versions 1.0.1 through 4.7.1-0 and CipherMail Webmail Messenger versions 1.1.1 through 3.1.1-0. The vulnerability allows attackers with administrative access to the web interface to escalate their privileges to the Unix root account (Core Security, CipherMail Blog).

The vulnerability exists in two main components: 1) The backup/restore functionality, where an attacker can modify SQL backup files to include system commands that execute with elevated privileges when restored, and 2) The MTA configuration page, where an administrator can modify the Postfix main configuration file to execute arbitrary commands as root when Postfix reloads the configuration. The vulnerability has a CVSS v3.1 base score of 7.2 HIGH (Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) (Core Security).

The vulnerability allows an attacker with administrative access to escalate privileges to the Unix root account, potentially gaining complete control over the system. This could lead to unauthorized access to sensitive email data, system configuration changes, and full system compromise (CipherMail Blog).

The vulnerability requires administrative access to the web interface to exploit. Proof-of-concept code exists demonstrating two attack vectors: 1) Manipulating backup files to include malicious system commands, and 2) Injecting commands into the Postfix configuration file (Core Security).

The vulnerability has been fixed in CipherMail Gateway 4.8.0 and Webmail Messenger 3.2.0. For older releases, patches are available that restrict configuration settings and disable restore functionality from the web interface. The fix includes adding a variable containing a list of safe settings and requiring additional system password authentication for restore operations (CipherMail Blog).