CVE-2020-28026
📋 TL;DR
CVE-2020-28026 is a critical vulnerability in Exim mail servers that allows unauthenticated remote attackers to execute arbitrary commands as root when Delivery Status Notification (DSN) is enabled. This affects Exim installations with non-default configurations that have DSN enabled, potentially giving attackers complete control over affected systems.
💻 Affected Systems
- Exim
📦 What is this software?
Exim by Exim
⚠️ Risk & Real-World Impact
Worst Case
Remote unauthenticated attacker gains root shell access, leading to complete system compromise, data theft, and potential lateral movement within the network.
Likely Case
Attackers exploit vulnerable internet-facing Exim servers to install malware, create backdoors, or use systems for cryptocurrency mining or DDoS attacks.
If Mitigated
With proper network segmentation and monitoring, impact is limited to the mail server system, but root access still allows significant damage.
🎯 Exploit Status
Exploitation is straightforward once DSN is enabled. Multiple proof-of-concept exploits are publicly available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Exim 4.94.2 and later
Vendor Advisory: https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28026-FGETS.txt
Restart Required: Yes
Instructions:
1. Download Exim 4.94.2 or later from exim.org
2. Stop Exim service: systemctl stop exim
3. Install new version following distribution-specific package procedures
4. Restart Exim: systemctl start exim
5. Verify service is running and patched
🔧 Temporary Workarounds
Disable DSN feature
linuxDisable Delivery Status Notification (DSN) functionality since vulnerability only exists when DSN is enabled
Edit Exim configuration to remove or comment out DSN-related options
Set 'dsn_advertise_hosts =' to empty in exim.conf
Network access restrictions
linuxRestrict access to Exim service to trusted networks only
iptables -A INPUT -p tcp --dport 25 -s TRUSTED_NETWORK -j ACCEPT
iptables -A INPUT -p tcp --dport 25 -j DROP
🧯 If You Can't Patch
- Disable DSN functionality immediately in Exim configuration
- Implement strict network filtering to limit Exim SMTP port access to only necessary IP addresses
🔍 How to Verify
Check if Vulnerable:
Check Exim version and DSN configuration: exim -bV | grep 'Exim version' and grep for 'dsn' in exim.confCheck Version:
exim -bV | grep 'Exim version'Verify Fix Applied:
Verify Exim version is 4.94.2 or higher: exim -bV | grep 'Exim version'📡 Detection & Monitoring
Log Indicators:
- Unusual ORCPT= parameters in mail logs
- Multiple failed DSN attempts
- Suspicious command execution in system logs
Network Indicators:
- Unusual SMTP traffic patterns
- Exploit attempts on port 25
- Unexpected outbound connections from Exim server
SIEM Query:
source="exim.log" AND (ORCPT=*\n* OR "delivery status notification" AND error)