CVE-2024-28054 – This vulnerability in Amavis email filtering so... (How to Fix)

Q: What is the severity of CVE-2024-28054?

CVE-2024-28054 has a CVSS score of 7.4 (HIGH). This vulnerability in Amavis email filtering software allows attackers to bypass malware and banned file checks by crafting emails with multiple MIME boundary parameters. The interpretation conflict between Amavis and some mail user agents leads to incorrect parsing, potentially allowing malicious content to pass through undetected. Organizations using vulnerable Amavis versions for email filtering are affected.

📋 TL;DR

This vulnerability in Amavis email filtering software allows attackers to bypass malware and banned file checks by crafting emails with multiple MIME boundary parameters. The interpretation conflict between Amavis and some mail user agents leads to incorrect parsing, potentially allowing malicious content to pass through undetected. Organizations using vulnerable Amavis versions for email filtering are affected.

💻 Affected Systems

Products:

Amavis

Versions: Amavis before 2.12.3 and 2.13.x before 2.13.1

Operating Systems: Linux/Unix systems running Amavis

Default Config Vulnerable: ⚠️ Yes

Notes: Affects systems using Amavis for email filtering, particularly those relying on its malware/banned file detection capabilities.

⚠️ Manual Verification Required

This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.

Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).

🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.

Recommended Actions:

Review the CVE details at NVD
Check vendor security advisories for your specific version
Test if the vulnerability is exploitable in your environment
Consider updating to the latest version as a precaution

⚠️ Risk & Real-World Impact

🔴

Worst Case

Malware or banned files bypass email filtering entirely, leading to successful malware distribution, data exfiltration, or ransomware deployment through email channels.

🟠

Likely Case

Attackers successfully deliver malicious attachments or content that would normally be blocked, increasing malware infection risk and potential data breaches.

🟢

If Mitigated

With proper network segmentation and additional security layers, the impact is limited to potential email-borne threats that other controls might catch.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires sending specially crafted emails but doesn't require authentication to the Amavis system itself.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Amavis 2.12.3 or 2.13.1

Vendor Advisory: https://gitlab.com/amavis/amavis/-/raw/v2.13.1/README_FILES/README.CVE-2024-28054

Restart Required: Yes

Instructions:

1. Backup current Amavis configuration. 2. Update Amavis to version 2.12.3 or 2.13.1 using your distribution's package manager. 3. Restart Amavis service. 4. Verify the update was successful.

🔧 Temporary Workarounds

Temporary MIME boundary filtering

linux

Add custom filtering rules to reject or quarantine emails with multiple MIME boundary parameters

Add to Amavis configuration: $sa_kill_level_deflt = 999;
Configure custom @bypass_virus_checks_maps rules

🧯 If You Can't Patch

Implement additional email filtering layer before Amavis to detect multiple MIME boundaries
Increase monitoring of email traffic and implement strict attachment handling policies

🔍 How to Verify

Check if Vulnerable:

Check Amavis version: amavisd-new -V | grep version

Check Version:

amavisd-new -V | grep version

Verify Fix Applied:

Verify version is 2.12.3 or higher, or 2.13.1 or higher, and test with sample emails containing multiple boundaries

📡 Detection & Monitoring

Log Indicators:

Unusual email acceptance patterns
Multiple boundary parameters in email headers
Failed malware scans for emails that should be blocked

Network Indicators:

Emails with multiple Content-Type boundary parameters
Unusual attachment types bypassing filters

SIEM Query:

source="amavis" AND ("boundary" NEAR/2 "boundary") OR ("multiple boundary" OR "Content-Type.*boundary.*boundary")

📊 Metadata

CVE ID: CVE-2024-28054

CVSS v3 Score: 7.4 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE: CWE-436

Published: March 18, 2024

Last Updated: November 4, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-28054, you might also want to check these: