CVE-2023-2868:

Remote Command Injection Vulnerability in Barracuda Email Security Gateway

Score
A numerical rating that indicates how dangerous this vulnerability is.

9.8Critical

Published Date:May 24, 2023
CISA KEV Date:May 26, 2023
Industries Affected:20

Armis Early Warning:

2 Days

Threat Predictions

EPSS Score:89.8
EPSS Percentile:100%

Exploitability

Score:3.9
Attack Vector:NETWORK
Attack Complexity:LOW
Privileges Required:NONE
User Interaction:NONE
Scope:UNCHANGED

Impact

Score:5.9
Confidentiality Impact:HIGH
Integrity Impact:HIGH
Availability Impact:HIGH

Description Preview

Remote Command Injection Vulnerability in Barracuda Email Security Gateway

Overview

This vulnerability (CWE-77: Command Injection) allows remote attackers to execute arbitrary commands on affected Barracuda Email Security Gateway appliances. The issue occurs during the processing of .tar archives when the system fails to properly validate the names of files contained within these archives. By manipulating file names in a specific way, attackers can inject system commands that will be executed through Perl's qx operator with the same privileges as the Email Security Gateway service. This represents a severe security risk as it could allow unauthorized access, data exfiltration, or complete system compromise.

Remediation

Barracuda has addressed this vulnerability with the BNSF-36456 patch, which has been automatically applied to all customer appliances. Organizations using Barracuda Email Security Gateway should:
1. Verify that their appliance has received the automatic update by checking the current version.
2. Monitor system logs for any suspicious activities that might indicate exploitation attempts.
3. Consider implementing additional network security controls to restrict access to the Email Security Gateway management interfaces.
4. Follow Barracuda's security advisories for any additional guidance or recommendations.