URLAUTH Token Forgery in Cyrus IMAP

Executive Summary

This vulnerability in Cyrus IMAP through 3.12.2 allows an attacker to forge a URLAUTH token by exploiting a missing mboxkey. If the attacker knows a folder name on a victim's account that the victim never used with auth URL, they can compute an HMAC-SHA1 value with a predictable key to create a valid token, gaining unauthorized read access to the mailbox.

Useful 0 Not Useful 0

Detection Guidance

Detection may involve checking for unauthorized URLAUTH token usage or suspicious access to mailboxes. Since URLAUTH is an obscure feature, review Cyrus IMAP logs for unusual auth URL requests or access patterns. No specific commands are provided in the context.

Useful 0 Not Useful 0

Impact Analysis

An attacker could gain unauthorized read access to your email folders if they know a folder name you never used with auth URL. However, the URLAUTH feature is obscure and rarely used, making the likelihood of exploitation very low.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade to the latest version of cyrus-imapd (3.12.2 or later) to address the missing mboxkey issue. If upgrading is not immediately possible, disable the URLAUTH feature in the configuration to prevent token forgery attempts.

Useful 0 Not Useful 0