This module exploits CVE-2023-7102, an arbitrary code execution vulnerability in Barracuda Email Security Gateway (ESG) appliances. The vulnerability exists in how the Amavis scanner processes Excel attachments using the Perl Spreadsheet::ParseExcel library.
The library's Utility.pm contains an unsafe eval() that processes Excel Number format strings without validation. By crafting a malicious XLS file with a specially formatted Number format string containing Perl code, an attacker can achieve remote code execution when the ESG scans the email attachment.
This module dynamically generates a minimal BIFF8 XLS file with the payload embedded in a FORMAT record using Rex::OLE. Payload constraints: no ']' (terminates format string) or single quotes (breaks Perl eval injection).
This vulnerability was exploited in the wild by UNC4841 (China-nexus threat actor) starting November 2023. Barracuda deployed automatic patches on December 21, 2023.
Affected versions: Barracuda ESG 5.1.3.001 through 9.2.1.001
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use exploit/linux/smtp/barracuda/esg_spreadsheet_rcemsf undefined(esg_spreadsheet_rce) > show actions ...actions...msf undefined(esg_spreadsheet_rce) > set ACTION < action-name >msf undefined(esg_spreadsheet_rce) > show options ...show and set options...msf undefined(esg_spreadsheet_rce) > runWith curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub