Experts Demonstrate Barracuda Email Security Gateway Chain Enabling Root Access Without Login
Two flaws in Barracuda's Email Security Gateway , an email-filtering appliance, can be chained to run commands on it as root, its highest level of access, with no login required.
Two flaws in Barracuda's Email Security Gateway , an email-filtering appliance, can be chained to run commands on it as root, its highest level of access, with no login required.
The company released patches on Monday, and the security firm watchTowr detailed the attack chain on Thursday; an unauthenticated attacker can use it to restore a crafted configuration backup and change the appliance's global settings.
Barracuda has released a patch for each affected product and lists the fixed firmware in its security advisory .
As of this week, neither flaw appears in CISA's Known Exploited Vulnerabilities (KEV catalog), and no public report ties either to an attack.
It runs commands as root but normally needs an administrator account, and on the Email Security Gateway the bypass gives an attacker that access.
The command injection reaches five other products, but on those it still needs an administrator account.
Chained, the two let an attacker reach root with no login.
A failed password change returns the attacker a low-privilege role instead of stopping the request, which leaves a backup-restore function open to someone who has not logged in.
Mandiant, which assigned the two CVE records, rates the bypass 9.3 out of 10 and the command injection 8.6; the Email Security Gateway is fixed in version 9.4.0.030 and later.
That function accepts an uploaded backup, and the restored data includes a timezone value that the appliance later runs as a shell command with root privileges.
Barracuda guards backups with a checksum, but the secret used to compute it is built into the code, allowing an attacker to forge a valid checksum.
watchTowr also released a detection tool that checks whether an appliance is vulnerable, but has not published an exploit.
That case is unrelated to the two flaws patched this week, and nothing ties the new pair to any attacker.
What happened
Two flaws in Barracuda's Email Security Gateway , an email-filtering appliance, can be chained to run commands on it as root, its highest level of access, with no login required.
The company released patches on Monday, and the security firm watchTowr detailed the attack chain on Thursday; an unauthenticated attacker can use it to restore a crafted configuration backup and change the appliance's global settings.
What changed
Barracuda has released a patch for each affected product and lists the fixed firmware in its security advisory .
As of this week, neither flaw appears in CISA's Known Exploited Vulnerabilities (KEV catalog), and no public report ties either to an attack.
Who is affected
It runs commands as root but normally needs an administrator account, and on the Email Security Gateway the bypass gives an attacker that access.
The command injection reaches five other products, but on those it still needs an administrator account.
Why it matters
Chained, the two let an attacker reach root with no login.
A failed password change returns the attacker a low-privilege role instead of stopping the request, which leaves a backup-restore function open to someone who has not logged in.
Technical details
Mandiant, which assigned the two CVE records, rates the bypass 9.3 out of 10 and the command injection 8.6; the Email Security Gateway is fixed in version 9.4.0.030 and later.
That function accepts an uploaded backup, and the restored data includes a timezone value that the appliance later runs as a shell command with root privileges.
Response
Barracuda guards backups with a checksum, but the secret used to compute it is built into the code, allowing an attacker to forge a valid checksum.
watchTowr also released a detection tool that checks whether an appliance is vulnerable, but has not published an exploit.
What security teams should do
That case is unrelated to the two flaws patched this week, and nothing ties the new pair to any attacker.
Attribution
The Hacker News: Two flaws in Barracuda's Email Security Gateway , an email-filtering appliance, can be chained to run commands on it as root, its highest level of access, with no login required.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.