CVE-2023-26490
📋 TL;DR
This vulnerability in mailcow's Sync Job feature allows authenticated users with specific permissions to execute arbitrary shell commands via command injection in the imapsync Perl script. Attackers can gain shell access to the Dovecot Docker container, potentially compromising the email system. Only users granted the Syncjob ACL permission are affected by default.
💻 Affected Systems
- mailcow-dockerized
📦 What is this software?
Mailcow\ by Mailcow
⚠️ Risk & Real-World Impact
Worst Case
Full compromise of the Dovecot container leading to email data theft, lateral movement to other containers in the bridged network, and persistent backdoor installation.
Likely Case
Unauthorized shell access to the Dovecot container allowing email data exfiltration and potential privilege escalation within the containerized environment.
If Mitigated
Limited impact if Syncjob ACL is properly restricted, with only authorized users able to trigger the vulnerability.
🎯 Exploit Status
Exploitation requires authenticated access and the Syncjob permission. The vulnerability is in publicly available code with clear injection points.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2023-03 update (March 3, 2023)
Vendor Advisory: https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-3j2f-wf52-cjg7
Restart Required: Yes
Instructions:
1. Update mailcow-dockerized to version 2023-03 or later. 2. Run ./update.sh from the mailcow directory. 3. Restart affected containers.
🔧 Temporary Workarounds
Remove Syncjob ACL
linuxRemove Syncjob ACL permission from all mailbox users to prevent creation or modification of Syncjobs.
docker-compose exec dovecot-mailcow doveadm acl remove -u <username> INBOX Syncjob
Repeat for all users or use script to batch remove
🧯 If You Can't Patch
- Immediately remove Syncjob ACL from all user accounts using doveadm commands
- Implement network segmentation to isolate the Dovecot container and monitor for suspicious shell activity
🔍 How to Verify
Check if Vulnerable:
Check mailcow version: cat /opt/mailcow-dockerized/VERSION. If version is older than 2023-03, check if any users have Syncjob ACL: docker-compose exec dovecot-mailcow doveadm acl get -u *Check Version:
cat /opt/mailcow-dockerized/VERSIONVerify Fix Applied:
Confirm version is 2023-03 or newer and verify no users have Syncjob ACL permission.📡 Detection & Monitoring
Log Indicators:
- Unusual shell commands in Dovecot logs
- imapsync processes with suspicious arguments
- Failed or abnormal Syncjob executions
Network Indicators:
- Unexpected outbound connections from Dovecot container
- Unusual traffic patterns from imapsync operations
SIEM Query:
source="dovecot" AND ("imapsync" OR "Syncjob") AND (command="*" OR shell="*")🔗 References
- https://github.com/mailcow/mailcow-dockerized/releases/tag/2023-03
- https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-3j2f-wf52-cjg7
- https://github.com/mailcow/mailcow-dockerized/releases/tag/2023-03
- https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-3j2f-wf52-cjg7
