CVE-2022-31138: OS Command Injection in mailcow
mailcow is a mailserver suite. Prior to mailcow-dockerized version 2022-06a, an extended privilege vulnerability can be exploited by manipulating the custom parameters regexmess, skipmess, regexflag, delete2foldersonly, delete2foldersbutnot, regextrans2, pipemess, or maxlinelengthcmd to execute arbitrary code. Users should update their mailcow instances with the update.sh script in the mailcow root directory to 2022-06a or newer to receive a patch for this issue. As a temporary workaround, the Syncjob ACL can be removed from all mailbox users, preventing changes to those settings.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
mailcow-dockerizedto a version that resolves this vulnerability.Fixed in 2022-06a - Configuration
As a temporary workaround, remove the Syncjob ACL from all mailbox users to prevent changes to those settings.
mailbox users Syncjob ACL = removed
Event History
Frequently Asked Questions
What is CVE-2022-31138?
CVE-2022-31138 is an extended privilege vulnerability in mailcow-dockerized version 2022-06a.
How can CVE-2022-31138 be exploited?
CVE-2022-31138 can be exploited by manipulating certain custom parameters in the mailcow software.
What is the severity of CVE-2022-31138?
CVE-2022-31138 has a severity rating of critical (8.8).
Which versions of mailcow-dockerized are affected by CVE-2022-31138?
mailcow-dockerized version 2022-06a is affected by CVE-2022-31138.
How can I fix CVE-2022-31138?
To fix CVE-2022-31138, update mailcow-dockerized to a version that includes the fix.