SEPPmail Secure Email Gateway Perl Code Injection

Executive Summary

SEPPmail Secure Email Gateway before version 15.1.1 has a flaw where attacker-controlled replacement text in sender or recipient rules can be evaluated as Perl code. An unauthenticated remote sender can execute operating-system commands in the mail-processing worker context if an active rule uses message-derived replacement data and its search condition matches. The affected worker context runs with root privileges.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an unauthenticated attacker to execute arbitrary operating-system commands on the mail-processing server with root privileges. This could lead to full system compromise, data theft, or disruption of email services.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could severely impact compliance with GDPR and HIPAA by enabling unauthorized access to sensitive data, potential data breaches, and loss of control over email systems handling protected information. Organizations using vulnerable versions may face regulatory penalties and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Update SEPPmail Secure Email Gateway to version 15.1.1 or later to address the vulnerability. Disable any active sender or recipient replacement rules that use message-derived replacement data until the update is applied.

Useful 0 Not Useful 0