[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[FD] CVE-2025-68624: Cross-Tenant Authentication Bypass by Spoofing in N-able Mail Assure

CVE-2025-68624: Cross-Tenant Authentication Bypass by Spoofing in N-able Mail 
Assure

CVE ID: CVE-2025-68624
Status: DISPUTED
CWE: CWE-290 (Authentication Bypass by Spoofing)
Affected Product: N-able Mail Assure (formerly SolarWinds MSP Mail Assure)
Affected Service: N-able Mail Assure cloud-based multi-tenant SMTP relay 
infrastructure
Vendor: N-able Technologies
Initial Discovery: October 2018
Public Disclosure: November 2025, DeepSec Vienna 2025
CVE Assignment: May 2026, following MITRE TL-Root dispute review


== Description ==

N-able Mail Assure contains a design-level authorization flaw that allows an 
authenticated SMTP user from one tenant to submit outbound email using sender 
addresses belonging to other unrelated tenants hosted on the same platform.

When connecting to the N-able Mail Assure SMTP relay and authenticating with 
valid credentials, the service accepts sender domains that are not bound to, 
delegated to, or otherwise authorized for the authenticated account. As a 
result, an authenticated user from Tenant A can submit email using a sender 
address belonging to Tenant B, despite there being no administrative 
relationship, consent, or delegation between the two tenants.

In the observed tests, the SMTP relay verified that the user had valid 
credentials, but did not verify that the authenticated identity was authorized 
to submit mail for the claimed sender domain.

Where the claimed sender domain authorizes the Mail Assure relay infrastructure 
in SPF and the message uses an aligned RFC5322.From domain, the resulting 
message can pass SPF and DMARC validation at the receiving MTA, including for 
domains configured with strict DMARC enforcement.

The root cause is a missing sender-domain authorization check at SMTP 
submission time.


== Impact ==

An authenticated Mail Assure user may be able to impersonate other domains 
hosted on the Mail Assure platform.

In the observed test case, this produced messages that:

- Passed SPF validation at the receiving MTA
- Passed DMARC validation
- Appeared as authenticated mail to the recipient environment
- Bypassed the protection expected from strict DMARC policies

This issue may enable phishing, Business Email Compromise (BEC), vendor 
impersonation, and other social engineering attacks against organizations that 
believe their domains are protected by correctly configured SPF and DMARC 
policies.

A March 2025 analysis documented in the accompanying technical paper identified 
approximately 17,000 domains relying on the Mail Assure platform.


== Proof of Concept Summary ==

The issue was validated using legitimate Mail Assure credentials from a tenant 
controlled by the researchers.

A controlled test showed that an authenticated account belonging to one Mail 
Assure tenant could submit an outbound message using a sender address belonging 
to a different, unaffiliated Mail Assure tenant domain.

Observed result:

- Authentication: valid credentials from Tenant A
- Claimed sender domain: Tenant B, unaffiliated with Tenant A
- SMTP result: message accepted for delivery
- Recipient environment: Microsoft 365
- Authentication result: SPF PASS and DMARC PASS
- Target domain policy: strict DMARC enforcement

Full SMTP session transcript, screenshots, and supporting evidence are 
documented in the technical paper (pages 33-36).

No credentials, tokens, private user data, or mailbox contents are published in 
this advisory. No harm was caused to any third-party domain or its users.


== Disclosure Timeline ==

October 2018       Vulnerability discovered during a penetration test and 
reported to SolarWinds security contacts.
2018-2024          Issue remained unresolved despite prior notification.
March 2025         Retest performed and issue confirmed as still exploitable.
November 2025      Public disclosure presented at DeepSec Vienna 2025.
December 2025      CVE request submitted to MITRE under Service Request 
#1964945.
January 2026       N-able PSIRT contacted during the CVE request process. 
N-able disputed the vulnerability classification.
Jan-April 2026     CVE dispute process conducted by MITRE TL-Root.
April 2026         N-able confirmed the cross-tenant sender behavior in 
correspondence with MITRE TL-Root.
May 2026           MITRE TL-Root determined that the issue meets CVE assignment 
criteria. CVE-2025-68624 assigned with the DISPUTED tag.


== Vendor Response ==

N-able disputes that the reported behavior constitutes a security vulnerability.

N-able's position is that the behavior is intended functionality of its shared 
SMTP relay architecture and that the service does not represent that it 
enforces per-tenant sender-domain binding.

The CVE record carries the DISPUTED tag to reflect the vendor's position.


== Recommended Mitigation ==

The SMTP relay should enforce sender-domain authorization at submission time.

Recommended controls include:

- Bind authenticated accounts to the domains they are authorized to send from
- Reject outbound messages where the authenticated identity is not authorized 
for the claimed MAIL FROM and RFC5322.From domains
- Require explicit delegation before allowing cross-domain sending
- Log and alert on attempted unauthorized cross-tenant sender-domain usage
- Provide tenant administrators with visibility into authorized sender domains 
and attempted violations


== References ==

- Technical paper, DeepSec Vienna 2025, Infinity-Day at Scale: Hijacking 
Registrars, Defeating 2FA and Spoofing 17,000+ Domains:
  
https://github.com/alessandrobertoldi/research/blob/main/infinity-day-at-scale-deepsec2025.pdf
- Advisory (GitHub Gist):
  https://gist.github.com/alessandrobertoldi/1ebe0f48aa0119d787ac0ff710057d92
- N-able Mail Assure product page:
  https://www.n-able.com/products/mail-assure
- CVE record:
  https://www.cve.org/CVERecord?id=CVE-2025-68624


== Credits ==

Discovered and reported by:
Alessandro Bertoldi, Bertoldi Cybersecurity
https://bcsec.io/eng.html
https://linkedin.com/in/bertoldicybersecurity

Co-author:
Enrico Bertoldi, Bertoldi Cybersecurity
https://bcsec.io/eng.html

Original 2018 disclosure:
Bertoldi Cybersecurity Team


"Empowering your business with cutting-edge cybersecurity solutions, 
safeguarding your digital assets and ensuring a seamless, secure experience for 
your customers."
BertoldiCybersecurity
Alessandro Bertoldi

Owner
T. +39 0185 799079

M. +39 348 5130136
E-Mail alessandro@xxxxxxxxxxxxxxxxxxxxxxxxx
www.bertoldicybersecurity.comhttps://bcsec.io

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/