Path Coercion in SmarterMail Preview Enables NTLM Relay Attacks

Detection Guidance

You can detect this vulnerability by monitoring for outbound SMB authentication attempts from the SmarterMail service to unusual or attacker-controlled hosts. On Windows systems, use network monitoring tools or commands like 'netstat -an' to identify outbound SMB connections (typically on port 445). Additionally, inspect SmarterMail logs for any base64-decoded path inputs or unusual access patterns to the background-of-the-day preview endpoint.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in SmarterTools SmarterMail versions prior to build 9518 and involves an unauthenticated path coercion in the background-of-the-day preview endpoint. The application base64-decodes attacker-supplied input and uses it as a filesystem path without validation. On Windows systems, this allows UNC paths to be resolved, causing the SmarterMail service to initiate outbound SMB authentication attempts to attacker-controlled hosts.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can be abused for credential coercion, NTLM relay attacks, and unauthorized network authentication, potentially allowing attackers to gain unauthorized access or relay credentials within the network.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include updating SmarterMail to a version at or above build 9518 where the vulnerability is fixed. If an update is not immediately possible, restrict outbound SMB traffic from the SmarterMail server to prevent it from initiating SMB authentication attempts to attacker-controlled hosts. Additionally, monitor and block suspicious base64-encoded inputs to the background-of-the-day preview endpoint.

Useful 0 Not Useful 0