CVE-2020-28021: Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters. An authenticated remote SMTP client can insert newline characters into a spool file (which…

PriorityP358high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EPSS

4.06%

89.4th percentile

Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters. An authenticated remote SMTP client can insert newline characters into a spool file (which indirectly leads to remote code execution as root) via AUTH= in a MAIL FROM command.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
debian	exim4	< exim4 4.94.2-1 (bookworm)	exim4 4.94.2-1 (bookworm)
exim	exim	>= 4.00 < 4.94.2	4.94.2

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C

osv8.8HIGH

vendor_debian8.8HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

Suricata

ET EXPLOIT Exim New-Line Injection into Spool Header File Inbound M2 (CVE-2020-28021)

suricata·2021-05-04·CVSS 8.8

CVE-2020-28021 [HIGH] ET EXPLOIT Exim New-Line Injection into Spool Header File Inbound M2 (CVE-2020-28021) ET EXPLOIT Exim New-Line Injection into Spool Header File Inbound M2 (CVE-2020-28021) Rule: alert smtp any any -> [$HOME_NET,$HTTP_SERVERS,$SMTP_SERVERS] any (msg:"ET EXPLOIT Exim New-Line Injection into Spool Header File Inbound M2 (CVE-2020-28021)"; flow:established,to_server; content:"MAIL|20|FROM"; content:"AUTH="; distance:0; pcre:"/^[^\+]+(?:\+[A-F0-9]{2}){4,}/R"; content:"+0A"; fast_pattern; reference:url,www.qualys.com/2021/05/04/21nails/21nails.txt; reference:cve,2020-28021; classtype:attempted-admin; sid:2032901; rev:1; metadata:attack_target SMTP_Server, created_at 2021_05_04, cve CVE_2020_28021, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_05_04;)

Suricata

ET EXPLOIT Exim New-Line Injection into Spool Header File Inbound M1 (CVE-2020-28021)

suricata·2021-05-04·CVSS 8.8

CVE-2020-28021 [HIGH] ET EXPLOIT Exim New-Line Injection into Spool Header File Inbound M1 (CVE-2020-28021) ET EXPLOIT Exim New-Line Injection into Spool Header File Inbound M1 (CVE-2020-28021) Rule: alert smtp any any -> [$HOME_NET,$HTTP_SERVERS,$SMTP_SERVERS] any (msg:"ET EXPLOIT Exim New-Line Injection into Spool Header File Inbound M1 (CVE-2020-28021)"; flow:established,to_server; content:"MAIL|20|FROM"; content:"AUTH="; distance:0; pcre:"/^[^\+]+\+0A/R"; content:"+0A"; fast_pattern; reference:url,www.qualys.com/2021/05/04/21nails/21nails.txt; reference:cve,2020-28021; classtype:attempted-admin; sid:2032900; rev:1; metadata:attack_target SMTP_Server, created_at 2021_05_04, cve CVE_2020_28021, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_05_04;)

Suricata

ET EXPLOIT Exim New-Line Injection into Spool Header File Inbound - Information Disclosure Attempt (CVE-2020-28021)

suricata·2021-05-04·CVSS 8.8

CVE-2020-28021 [HIGH] ET EXPLOIT Exim New-Line Injection into Spool Header File Inbound - Information Disclosure Attempt (CVE-2020-28021) ET EXPLOIT Exim New-Line Injection into Spool Header File Inbound - Information Disclosure Attempt (CVE-2020-28021) Rule: alert smtp any any -> [$HOME_NET,$HTTP_SERVERS,$SMTP_SERVERS] any (msg:"ET EXPLOIT Exim New-Line Injection into Spool Header File Inbound - Information Disclosure Attempt (CVE-2020-28021)"; flow:established,to_server; content:"MAIL|20|FROM"; content:"AUTH="; distance:0; pcre:"/^.{0,100}\+0A.{0,100}\x40/R"; content:"+0A"; fast_pattern; content:"|40|"; reference:url,www.qualys.com/2021/05/04/21nails/21nails.txt; reference:cve,2020-28021; classtype:attempted-admin; sid:2032902; rev:1; metadata:attack_target SMTP_Server, created_at 2021_05_04, cve CVE_2020_28021, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Description_Generated