Cisco Secure Email Gateway AMP Arbitrary File Write RCE

Description

An unauthenticated attacker sends an email containing a crafted tar attachment through Cisco Secure Email Gateway. Inside the tar, a POSIX pax extended header applies `linkpath=bin/core_watch.sh` to a hard-link member. That member also contains the module's shell command launcher.

AMP File Reputation decodes the email attachment and passes the tar to `libunarchv`, AMP's native archive extractor. `libunarchv` runs as root and uses libarchive to write archive members. Its `update_full_pathname()` function replaces the member pathname in `archive_entry_pathname()` with a generated pathname in AMP's temporary extraction directory. It leaves `archive_entry_hardlink()`, which holds the pax `linkpath`, under the attacker's control.

Libarchive asks the operating system to create the generated pathname as a hard link to `bin/core_watch.sh`. AMP's working directory is `/data`, so this relative `linkpath` resolves to `/data/bin/core_watch.sh`. A hard link is another pathname for the same file. When libarchive writes the member's data through the generated pathname, it therefore truncates and replaces `core_watch.sh`. This primitive overwrites an existing file; it cannot create the file named by `linkpath`, and both pathnames must be on the same filesystem.

The flaw is in `libunarchv`'s hard-link validation, not the pax format. The module uses the file overwrite to replace /data/bin/core_watch.sh with a shell command launcher. The system crontab runs this script as root every five minutes. Before running the payload, the launcher truncates the replaced file to prevent another payload execution. Three other Cisco scripts are hard links to the same file and are also left empty. The appliance requires repair after exploitation.

The check sends the hidden EUQ_FULL SMTP command to identify an AsyncOS mail service. SMTP does not reveal the Content Scanner Tools version or whether File Reputation is enabled on a mail policy, so the check reports only that the product was detected.

File Reputation must be enabled and assigned to a mail policy, and Content Scanner Tools must be earlier than 25.3.0.5525.