CVE-2024-39929
📋 TL;DR
This vulnerability in Exim mail servers allows attackers to bypass filename extension filtering by using specially crafted multiline RFC 2231 headers. Attackers can deliver executable attachments that would normally be blocked, potentially delivering malware to end users' mailboxes. Organizations running vulnerable Exim versions as mail transfer agents are affected.
💻 Affected Systems
- Exim
📦 What is this software?
Exim by Exim
⚠️ Risk & Real-World Impact
Worst Case
Attackers deliver executable malware attachments directly to user mailboxes, bypassing security filters, leading to malware execution and potential system compromise.
Likely Case
Attackers deliver executable attachments that bypass filename filtering, increasing phishing and malware delivery success rates.
If Mitigated
With proper attachment scanning and user education, the risk is reduced to nuisance spam or blocked by additional security layers.
🎯 Exploit Status
Exploitation requires sending specially crafted emails but does not require authentication to the mail server.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.98-RC3 and later
Vendor Advisory: https://bugs.exim.org/show_bug.cgi?id=3099
Restart Required: Yes
Instructions:
1. Download Exim 4.98-RC3 or later from exim.org. 2. Compile and install following Exim documentation. 3. Restart Exim service. 4. Verify version with 'exim -bV'.
🔧 Temporary Workarounds
Enhanced attachment filtering
allImplement additional attachment scanning beyond filename extension checks
Disable problematic MIME handling
linuxConfigure Exim to reject or sanitize RFC 2231 headers
Add to Exim configuration: 'untrusted_set_sender = *' and appropriate ACL rules
🧯 If You Can't Patch
- Implement external email filtering/gateway with attachment scanning
- Enable additional antivirus/antimalware scanning on mail server and endpoints
🔍 How to Verify
Check if Vulnerable:
Check Exim version with 'exim -bV | head -1'. If version is 4.97.1 or earlier, system is vulnerable.Check Version:
exim -bV | head -1Verify Fix Applied:
After patching, verify version is 4.98-RC3 or later with 'exim -bV | head -1'.📡 Detection & Monitoring
Log Indicators:
- Unusual multiline header patterns in email logs
- Failed attachment blocking events followed by deliveries
Network Indicators:
- Emails with multiline RFC 2231 headers containing executable extensions
SIEM Query:
source="exim" AND "RFC2231" AND ("exe" OR "bat" OR "sh" OR executable extension)🔗 References
- https://bugs.exim.org/show_bug.cgi?id=3099#c4
- https://git.exim.org/exim.git/commit/1b3209b0577a9327ebb076f3b32b8a159c253f7b
- https://git.exim.org/exim.git/commit/6ce5c70cff8989418e05d01fd2a57703007a6357
- https://github.com/Exim/exim/compare/exim-4.98-RC2...exim-4.98-RC3
- https://www.rfc-editor.org/rfc/rfc2231.txt
- https://bugs.exim.org/show_bug.cgi?id=3099#c4
- https://git.exim.org/exim.git/commit/1b3209b0577a9327ebb076f3b32b8a159c253f7b
- https://git.exim.org/exim.git/commit/6ce5c70cff8989418e05d01fd2a57703007a6357
- https://github.com/Exim/exim/compare/exim-4.98-RC2...exim-4.98-RC3
- https://www.rfc-editor.org/rfc/rfc2231.txt
