Description
This module exploits CVE-2023-2868, a command injection vulnerability in Barracuda Email Security Gateway (ESG) appliances. The vulnerability exists in how the ESG processes TAR file attachments - filenames containing shell metacharacters (backticks) are passed directly to shell commands during extraction, allowing remote command execution.
The exploit sends an email with a specially crafted TAR attachment where the filename contains a backtick-wrapped command. When the ESG processes this attachment, the command is executed as the mail processing user.
Note: Payload execution may take 30-90 seconds after email delivery. Amavisd queues and processes attachments asynchronously.
Affected versions: Barracuda ESG firmware prior to May 2023 patch.
Payloads containing single quotes or backticks are incompatible with the injection mechanism. Use cmd/unix/generic with a custom CMD for specialized payload requirements.
Module options
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use exploit/linux/smtp/barracuda/esg_tarfile_rcemsf undefined(esg_tarfile_rce) > show actions ...actions...msf undefined(esg_tarfile_rce) > set ACTION < action-name >msf undefined(esg_tarfile_rce) > show options ...show and set options...msf undefined(esg_tarfile_rce) > runPrioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub