module

Barracuda ESG TAR Filename Command Injection

Try Surface Command
Back to search
Disclosed
May 23, 2023
Created
Mar 24, 2026

Description

This module exploits CVE-2023-2868, a command injection vulnerability in
Barracuda Email Security Gateway (ESG) appliances. The vulnerability exists
in how the ESG processes TAR file attachments - filenames containing shell
metacharacters (backticks) are passed directly to shell commands during
extraction, allowing remote command execution.

The exploit sends an email with a specially crafted TAR attachment where
the filename contains a backtick-wrapped command. When the ESG processes
this attachment, the command is executed as the mail processing user.

Note: Payload execution may take 30-90 seconds after email delivery.
Amavisd queues and processes attachments asynchronously.

Affected versions: Barracuda ESG firmware prior to May 2023 patch.

Payloads containing single quotes or backticks are incompatible with
the injection mechanism. Use cmd/unix/generic with a custom CMD for
specialized payload requirements.

Authors

Mandiant
cfielding-r7
Curt Hyvarinen

Platform

Unix

Architectures

cmd

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':


    msf > use exploit/linux/smtp/barracuda_esg_tarfile_rce
    msf exploit(barracuda_esg_tarfile_rce) > show targets
        ...targets...
    msf exploit(barracuda_esg_tarfile_rce) > set TARGET < target-id >
    msf exploit(barracuda_esg_tarfile_rce) > show options
        ...show and set options...
    msf exploit(barracuda_esg_tarfile_rce) > exploit
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.