CVE-2019-12924
📋 TL;DR
MailEnable Enterprise Premium 10.23 contains an XML External Entity Injection (XXE) vulnerability that allows unauthenticated attackers to read arbitrary files on the host system. Since credentials are stored in cleartext, this can lead to complete credential theft including administrative accounts. All systems running the vulnerable version are affected.
💻 Affected Systems
- MailEnable Enterprise Premium
📦 What is this software?
Mailenable by Mailenable
Mailenable by Mailenable
Mailenable by Mailenable
Mailenable by Mailenable
Mailenable by Mailenable
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via credential theft leading to domain takeover, data exfiltration, and lateral movement within the network.
Likely Case
Credential theft of all MailEnable users including administrators, potentially leading to email account compromise and further attacks.
If Mitigated
Limited file read capability but no credential access if proper file permissions and network segmentation are in place.
🎯 Exploit Status
Public technical advisory includes exploitation details. XXE attacks are well-documented and tools exist for automated exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.24 or later
Vendor Advisory: http://www.mailenable.com/Premium-ReleaseNotes.txt
Restart Required: Yes
Instructions:
1. Download MailEnable Enterprise Premium 10.24 or later from vendor website. 2. Backup current configuration and data. 3. Run the installer to upgrade. 4. Restart MailEnable services. 5. Verify the upgrade completed successfully.
🔧 Temporary Workarounds
Disable external entity processing
windowsConfigure XML processor to disable external entity resolution
Modify XML parser configuration to set: feature_external_general_entities = false
Set feature_external_parameter_entities = false
Network segmentation
allRestrict access to MailEnable services to trusted networks only
Configure firewall rules to limit inbound connections to MailEnable ports
🧯 If You Can't Patch
- Implement strict network access controls to limit exposure to trusted IPs only
- Monitor for XXE attack patterns in web server logs and implement WAF rules to block XXE payloads
🔍 How to Verify
Check if Vulnerable:
Check MailEnable version in administrative console or registry: HKEY_LOCAL_MACHINE\SOFTWARE\MailEnable\Premium\VersionCheck Version:
reg query "HKLM\SOFTWARE\MailEnable\Premium" /v VersionVerify Fix Applied:
Verify version is 10.24 or later and test XXE payloads no longer return file contents📡 Detection & Monitoring
Log Indicators:
- XML requests containing DOCTYPE declarations
- File read attempts via XML entities
- Unusual file access patterns from MailEnable process
Network Indicators:
- HTTP requests with XML payloads containing external entity references
- Outbound connections to malicious DTD servers
SIEM Query:
source="mailenable.log" AND ("DOCTYPE" OR "ENTITY" OR "SYSTEM")🔗 References
- http://www.mailenable.com/Premium-ReleaseNotes.txt
- https://www.nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-in-mailenable/
- http://www.mailenable.com/Premium-ReleaseNotes.txt
- https://www.nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-in-mailenable/
