CVE-2017-7692
published 2017-04-20CVE-2017-7692: SquirrelMail 1.4.22 (and other versions before 20170427_0200-SVN) allows post-authentication remote code execution via a sendmail.cf file that is mishandled in…
PriorityP183high8.8CVSS 3.0
AVNACLPRLUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
32.16%
98.1th percentile
SquirrelMail 1.4.22 (and other versions before 20170427_0200-SVN) allows post-authentication remote code execution via a sendmail.cf file that is mishandled in a popen call. It's possible to exploit this vulnerability to execute arbitrary shell commands on the remote server. The problem is in the Deliver_SendMail.class.php with the initStream function that uses escapeshellcmd() to sanitize the sendmail command before executing it. The use of escapeshellcmd() is not correct in this case since it doesn't escape whitespaces, allowing the injection of arbitrary command parameters. The problem is in -f$envelopefrom within the sendmail command line. Hence, if the target server uses sendmail and SquirrelMail is configured to use it as a command-line program, it's possible to trick sendmail into using an attacker-provided configuration file that triggers the execution of an arbitrary command. For exploitation, the attacker must upload a sendmail.cf file as an email attachment, and inject the sendmail.cf filename with the -C option within the "Options > Personal Informations > Email Address" setting.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oauth2-server_project | oauth2-server | 0 – 3.1.1 | — |
| squirrelmail | squirrelmail | — | — |
| squirrelmail | squirrelmail | >= 0 < 2:1.4.23~svn20120406-2+deb8u1build0.14.04.1 | 2:1.4.23~svn20120406-2+deb8u1build0.14.04.1 |
| squirrelmail | squirrelmail | >= 0 < 2:1.4.23~svn20120406-2+deb8u1ubuntu0.16.04.1 | 2:1.4.23~svn20120406-2+deb8u1ubuntu0.16.04.1 |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for injection of the -C flag into the SquirrelMail 'Email Address' field (Options > Personal Information), which is used to supply an attacker-controlled sendmail.cf configuration file to sendmail. ↗
- →Detect POST requests to /src/options.php?optpage=personal containing the -C parameter in the new_email_address field, which is the injection point for CVE-2017-7692 exploitation. ↗
- →Detect the Webworm threat actor executing the LegalHackers CVE-2017-7692 PoC script (_1.sh) via nuclei or bash against webmail targets; look for nuclei scans combined with dirsearch activity from the same host. ↗
- →Monitor outbound connections from SquirrelMail web servers to port 80 on 64.176.85[.]158, which was used as a Webworm proxy server hosting open-directory exploitation utilities. ↗
- →Flag any sendmail.cf file uploaded as an email attachment in SquirrelMail, as this is the attacker-supplied configuration file used to trigger arbitrary command execution via the -C sendmail option. ↗
- →The vulnerable code path is Deliver_SendMail.class.php initStream function; audit popen() calls in this file for unsanitised -f$envelopefrom arguments that allow whitespace-delimited parameter injection. ↗
- ·CVE-2017-7692 is only exploitable when SquirrelMail is configured to use sendmail as a command-line program; installations using SMTP delivery are not affected by this specific attack vector. ↗
- ·Exploitation requires prior authentication to SquirrelMail; unauthenticated attackers cannot trigger the RCE directly. ↗
- ·Red Hat Enterprise Linux 5 will not fix this issue; defenders on RHEL 5 should apply compensating controls rather than expecting a vendor patch. ↗
CVSS provenance
nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C
ghsa9.1CRITICAL
osv8.8HIGH
vulncheck8.8HIGH
vendor_redhat8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-w6jv-pvcq-chp4: SquirrelMail 1
ghsa_unreviewed·2022-05-17
CVE-2017-7692 [HIGH] CWE-20 GHSA-w6jv-pvcq-chp4: SquirrelMail 1
SquirrelMail 1.4.22 (and other versions before 20170427_0200-SVN) allows post-authentication remote code execution via a sendmail.cf file that is mishandled in a popen call. It's possible to exploit this vulnerability to execute arbitrary shell commands on the remote server. The problem is in the Deliver_SendMail.class.php with the initStream function that uses escapeshellcmd() to sanitize the sendmail command before executing it. The use of escapeshellcmd() is not correct in this case since it doesn't escape whitespaces, allowing the injection of arbitrary command parameters. The problem is in -f$envelopefrom within the sendmail command line. Hence, if the target server uses sendmail and SquirrelMail is configured to use it as a command-line program, it's possible to trick sendmail into u
GHSA
Code Injection in oauth2-server
ghsa·2021-04-22·CVSS 9.1
CVE-2017-18924 [HIGH] CWE-94 Code Injection in oauth2-server
Code Injection in oauth2-server
"oauth2-server (aka node-oauth2-server) through 3.1.1 implements OAuth 2.0 without PKCE. It does not prevent authorization code injection. This is similar to CVE-2020-7692. NOTE: the vendor states 'As RFC7636 is an extension, I think the claim in the Readme of "RFC 6749 compliant" is valid and not misleading and I also therefore wouldn't describe this as a "vulnerability" with the library per se.'"
OSV
CVE-2017-7692: SquirrelMail 1
osv·2017-04-20·CVSS 8.8
CVE-2017-7692 [HIGH] CVE-2017-7692: SquirrelMail 1
SquirrelMail 1.4.22 (and other versions before 20170427_0200-SVN) allows post-authentication remote code execution via a sendmail.cf file that is mishandled in a popen call. It's possible to exploit this vulnerability to execute arbitrary shell commands on the remote server. The problem is in the Deliver_SendMail.class.php with the initStream function that uses escapeshellcmd() to sanitize the sendmail command before executing it. The use of escapeshellcmd() is not correct in this case since it doesn't escape whitespaces, allowing the injection of arbitrary command parameters. The problem is in -f$envelopefrom within the sendmail command line. Hence, if the target server uses sendmail and SquirrelMail is configured to use it as a command-line program, it's possible to trick sendmail into u
VulnCheck
squirrelmail squirrelmail Improper Input Validation
vulncheck·2017·CVSS 8.8
CVE-2017-7692 [HIGH] squirrelmail squirrelmail Improper Input Validation
squirrelmail squirrelmail Improper Input Validation
SquirrelMail 1.4.22 (and other versions before 20170427_0200-SVN) allows post-authentication remote code execution via a sendmail.cf file that is mishandled in a popen call. It's possible to exploit this vulnerability to execute arbitrary shell commands on the remote server. The problem is in the Deliver_SendMail.class.php with the initStream function that uses escapeshellcmd() to sanitize the sendmail command before executing it. The use of escapeshellcmd() is not correct in this case since it doesn't escape whitespaces, allowing the injection of arbitrary command parameters. The problem is in -f$envelopefrom within the sendmail command line. Hence, if the target server uses sendmail and SquirrelMail is configured to use it as a command
Red Hat
squirrelmail: Insufficient escaping of user-supplied data
vendor_redhat·2017-04-19·CVSS 8.8
CVE-2017-7692 [HIGH] CWE-20 squirrelmail: Insufficient escaping of user-supplied data
squirrelmail: Insufficient escaping of user-supplied data
SquirrelMail 1.4.22 (and other versions before 20170427_0200-SVN) allows post-authentication remote code execution via a sendmail.cf file that is mishandled in a popen call. It's possible to exploit this vulnerability to execute arbitrary shell commands on the remote server. The problem is in the Deliver_SendMail.class.php with the initStream function that uses escapeshellcmd() to sanitize the sendmail command before executing it. The use of escapeshellcmd() is not correct in this case since it doesn't escape whitespaces, allowing the injection of arbitrary command parameters. The problem is in -f$envelopefrom within the sendmail command line. Hence, if the target server uses sendmail and SquirrelMail is configured to use it as a c
No detection rules found.
Bugzilla
CVE-2017-7692 squirrelmail: Insufficient escaping of user-supplied data [epel-all]
bugzilla·2017-04-25·CVSS 8.8
CVE-2017-7692 [HIGH] CVE-2017-7692 squirrelmail: Insufficient escaping of user-supplied data [epel-all]
CVE-2017-7692 squirrelmail: Insufficient escaping of user-supplied data [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versi
Bugzilla
CVE-2017-7692 squirrelmail: Insufficient escaping of user-supplied data
bugzilla·2017-04-25·CVSS 8.8
CVE-2017-7692 [HIGH] CVE-2017-7692 squirrelmail: Insufficient escaping of user-supplied data
CVE-2017-7692 squirrelmail: Insufficient escaping of user-supplied data
Squirrelmail is vulnerable to a remote code execution vulnerability because it fails to sanitize a string before passing it to a popen call. It's possible to exploit this vulnerability to execute arbitrary shell commands on the remote server.
References:
http://seclists.org/oss-sec/2017/q2/96
http://seclists.org/fulldisclosure/2017/Apr/81
http://seclists.org/oss-sec/2017/q2/114
Discussion:
Created squirrelmail tracking bugs for this issue:
Affects: epel-all [bug 1445166]
Affects: fedora-all [bug 1445167]
---
External References:
http://www.squirrelmail.org/security/issue/2017-04-24
Bugzilla
CVE-2017-7692 squirrelmail: Insufficient escaping of user-supplied data [fedora-all]
bugzilla·2017-04-25·CVSS 8.8
CVE-2017-7692 [HIGH] CVE-2017-7692 squirrelmail: Insufficient escaping of user-supplied data [fedora-all]
CVE-2017-7692 squirrelmail: Insufficient escaping of user-supplied data [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported v
Eset
Webworm: New burrowing techniques
blogs_eset·2026-05-20
CVE-2017-7692 Webworm: New burrowing techniques
ESET researchers analyzed the 2025 activity of Webworm, a China-aligned APT group that started out targeting organizations in Asia, but has recently shifted its focus to Europe. Even though this is our first public blogpost on the group, we have been observing Webworm’s activities ever since Symantec first reported on this threat actor in 2022. Over the years, we have seen that this threat actor continually changes its tactics, techniques, and procedures (TTPs).
Webworm is linked to other China-aligned APT groups such as SixLittleMonkeys and FishMonger. In the past, it made use of well-known malware families such as McRat (aka 9002 RAT) and Trochilus, though in recent years, it has started moving toward both existing and custom proxy tools, which are more stealthy than full-fledged backdo
http://openwall.com/lists/oss-security/2017/04/19/6http://openwall.com/lists/oss-security/2017/04/27/1http://www.debian.org/security/2017/dsa-3852http://www.securityfocus.com/bid/98067http://www.securitytracker.com/id/1038312https://legalhackers.com/advisories/SquirrelMail-Exploit-Remote-Code-Exec-CVE-2017-7692-Vuln.htmlhttps://security.gentoo.org/glsa/201709-13https://www.exploit-db.com/exploits/41910/http://openwall.com/lists/oss-security/2017/04/19/6http://openwall.com/lists/oss-security/2017/04/27/1http://www.debian.org/security/2017/dsa-3852http://www.securityfocus.com/bid/98067http://www.securitytracker.com/id/1038312https://legalhackers.com/advisories/SquirrelMail-Exploit-Remote-Code-Exec-CVE-2017-7692-Vuln.htmlhttps://security.gentoo.org/glsa/201709-13https://www.exploit-db.com/exploits/41910/
2017-04-20
Published
Exploited in the wild