[FD] Security advisory: multiple vulnerabilities including Pre-authentication root RCE in Xeams 10.3 build 6449 (Synametrics Technologies)

[disclosure via Fulldisclosure <fulldisclosure@xxxxxxxxxxxx>]

0day Rubbish Research Team is publicly disclosing 2 vulnerabilities in Xeams 
10.3 build 6449 (Synametrics Technologies). The research is published and a 
proof-of-concept is available.

Vulnerability 1: Pre-authentication root RCE (CVSS 9.8, pre-authentication)

A framework-level debug write primitive in the rules engine reads an 
attacker-controlled MIME header, X-SM_SAVE_BODY_4DEBUGGING, as an absolute file 
path and the message body as the file content, writing to any path on the host 
with no validation, no allowlist, and no authentication gate. The SMTP service 
accepts unauthenticated delivery by default (reqAuthForLocal=false is the 
global default). When Xeams runs as root, an attacker writes a cron job into 
/etc/cron.d/, which crond executes as root every minute, yielding a complete 
unauthenticated root RCE. The entire chain depends only on SMTP, requires no 
HTTP and no credentials, and was dynamically verified on both port 25 and port 
587 producing uid=0(root).

Impact: Arbitrary root command execution on the mail server host, full root 
read of the Xeams mail repository (all .eml envelope/subject/body), and 
complete control of the Xeams process; no credentials required.

Advisory: https://0day-rubbish.com/blog/xeams-smtp-savebody-cron-rce

Vulnerability 2: Pre-authentication root RCE (CVSS 9.8, pre-authentication)

The built-in SQLRunner.jsp administrative page is directly reachable without 
authentication: web.xml declares no security-constraint for JSPs, the 
SynaFilter maps only /FrontController/*, and NewPageHeader.jsp does not enforce 
authentication. Directly requesting SQLRunner.jsp bypasses the FrontController 
dispatch, the SynaFilter, and the operation-level authorization. The 
operation=1 branch performs no auth check and connects to the embedded Derby 
database using attacker-supplied credentials; Xeams hardcodes the Derby 
database-owner credentials system/manager, so an attacker reuses them. With the 
JDBC connection stored in the HTTP session, operation=2 issues arbitrary SQL, 
and calling the Derby procedure SYSCS_UTIL.SYSCS_EXPORT_QUERY writes an 
attacker-controlled JSP webshell into the Tomcat webapps/ROOT docBase. A 
subsequent GET triggers Jasper on-demand compilation and execution, yielding 
arbitrary command execution at the Xeams process privilege (root in the default 
deployment). T
 he chain requires only HTTP access to the Xeams web port (default 5272/TCP), 
no valid login, no CSRF token, and no prior session. The RCE was dynamically 
verified end-to-end producing uid=0(root).

Impact: Arbitrary command execution on the mail server host at the Xeams 
process privilege (root in the default deployment), full read of the Xeams mail 
repository and the host filesystem, and complete control of the Xeams process 
and embedded Derby database.

Advisory: https://0day-rubbish.com/blog/xeams-unauth-sqlrunner-derby-jsp-rce

PoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish

-- 
0day Rubbish Research Team
https://0day-rubbish.com
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/