CVE-2021-29157
📋 TL;DR
This path traversal vulnerability in Dovecot allows attackers with local filesystem access to bypass OAuth2 authentication by tricking the system into using attacker-controlled JWT validation keys. It affects Dovecot installations using local JWT validation with the posix filesystem driver. Systems with local user access are at risk.
💻 Affected Systems
- Dovecot
📦 What is this software?
Dovecot by Dovecot
Fedora by Fedoraproject
Fedora by Fedoraproject
⚠️ Risk & Real-World Impact
Worst Case
Complete authentication bypass leading to unauthorized access to email accounts and potential data exfiltration.
Likely Case
Local privilege escalation where authenticated users can access other users' email accounts.
If Mitigated
Limited impact if proper access controls and network segmentation are in place.
🎯 Exploit Status
Exploit requires local filesystem access and knowledge of path traversal techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.3.15 and later
Vendor Advisory: https://dovecot.org/security
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Update Dovecot to version 2.3.15 or later using your distribution's package manager. 3. Restart Dovecot service. 4. Verify the update was successful.
🔧 Temporary Workarounds
Disable local JWT validation
linuxSwitch to remote JWT validation or disable OAuth2 authentication if not required.
# Edit dovecot.conf and remove or comment out auth_oauth2_local_jwks_path
🧯 If You Can't Patch
- Implement strict filesystem permissions to limit access to JWT validation directories.
- Use network segmentation to restrict access to Dovecot servers from untrusted networks.
🔍 How to Verify
Check if Vulnerable:
Check Dovecot version with 'dovecot --version' and verify it's below 2.3.15, and check if OAuth2 with local JWT validation is configured.Check Version:
dovecot --versionVerify Fix Applied:
Verify Dovecot version is 2.3.15 or higher with 'dovecot --version' and test OAuth2 authentication functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual authentication attempts via OAuth2
- Failed JWT validation errors
- Path traversal patterns in log files
Network Indicators:
- Multiple authentication attempts from single source
- Unusual OAuth2 token usage patterns
SIEM Query:
source="dovecot.log" AND ("authentication failure" OR "JWT validation" OR "path traversal")🔗 References
- https://dovecot.org/security
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JB2VTJ3G2ILYWH5Y2FTY2PUHT2MD6VMI/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TK424DWFO2TKJYXZ2H3XL633TYJL4GQN/
- https://security.gentoo.org/glsa/202107-41
- https://www.openwall.com/lists/oss-security/2021/06/28/1
- https://dovecot.org/security
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JB2VTJ3G2ILYWH5Y2FTY2PUHT2MD6VMI/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TK424DWFO2TKJYXZ2H3XL633TYJL4GQN/
- https://security.gentoo.org/glsa/202107-41
- https://www.openwall.com/lists/oss-security/2021/06/28/1
