#SQUIRRELMAIL AUTHENTICATED USER CODE#

An authenticated attacker may be able to exploit the vulnerability to execute arbitrary commands on the target and compromise the remote system.

#SQUIRRELMAIL AUTHENTICATED USER CODE#

SquirrelMail is affected by a Remote Code Execution vulnerability which stems from insufficient escaping of user-supplied data when SquirrelMail has been configured with Sendmail as the main transport. SquirrelMail has released patches to address this vulnerability, for more details see: SquirrelMail has all the functionality you would want from an email client, including strong MIME support, address books, and folder manipulation.Īn independent security researcher, Dawid Golunski (), has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program. It has very few requirements and is very easy to configure and install. It includes built-in pure PHP support for the IMAP and SMTP protocols, and all pages render in pure HTML 4.0 (with no JavaScript required) for maximum compatibility across browsers. SquirrelMail is a standards-based webmail package written in PHP. (SquirrelMail authenticated user following advisory describes Remote Code Execution found in SquirrelMail version 1.4.22. Received: from (port=11233 helo=inode.at)īy with smtp (Exim 4.50) This is a copy of the message's headers. The following address(es) error from remote mailer after RCPT TO:: This message was created automatically by mail delivery software.Ī message that you sent could not be delivered to one or more of its This is the error log when i sent a mail to a account on hmailserver: I route the mail to an domain server from the domain server to an dyndns account.Ĭan i to this to send and recieve mails or not? SquirrelMail is affected by a Remote Code Execution vulnerability which stems from insufficient escaping of user-supplied data when SquirrelMail has been configured with Sendmail as the main transport. You may want to add an SPF record ASAP, as was the target date for domains to have SPF records in place (Hotmail, for example, started checking SPF records on ). This means that spammers can easily send out E-mail that looks like it came from your domain, which can make your domain look bad (if the recipient thinks you really sent it), and can cost you money (when people complain to you, rather than the spammer). WARN SPF record Your domain does not have an SPF record. By refusing this mail, you will never get reject/bounce messages, or return receipts, and you may get other mail server admins upset at you if they have to deal with your bounce messages.ĮRROR: 's MAILFROM response: 550 sender address must be specified. Mailservers are required by RFC1123 5.2.9 to accept mail from ''. sighįAILĚcceptance of NULL senderĞRROR: One or more of your mailservers does not accept mail from ''.

I do have like 5 domains, and all those domains get handled via that one mx. SMTP server, but GMX.DE does not accept my emails anymore.

resolves to the same IP as īasicly, maybe it looks if the sending SMTP server has the same domain name as the sender of the email? but when my users send email to gmx.de it bounces. This allows a remote attacker to perform a Cross Site Request Forgery (. I am not sure if that popped up lately or if I just didn't notice before. SquirrelMail, a webmail application, does not employ a user-specific token for webforms.

Squirrelmail authenticated user