QID 150701

Date Published: 2023-11-23

QID 150701: Barracuda Email Security Gateway (ESG) Command Injection Vulnerability (CVE-2023-2868)

The Barracuda Email Security Gateway (ESG) is an email security gateway that manages and filters all inbound and outbound email traffic to protect organizations from email-borne threats and data leaks.

A remote command injection vulnerability exists in the Barracuda Email Security Gateway out of a failure to comprehensively sanitize the processing of .tar file (tape archives). The vulnerability stems from incomplete input validation of a user-supplied .tar file as it pertains to the names of the files contained within the archive.

Affected Products:
Barracuda ESG from version 5.1.3.001 up to 9.2.0.006

QID Detection Logic (Authenticated):
This QID sends an authenticated GET request and checks for vulnerable version of Barracuda ESG running on the target system.

NOTE: For Selenium based authentication please use Qualys Browser Recorder. For more details on creating Selenium scripts please refer Qualys Browser Recorder Guide.

Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the target system with the privileges of the Email Security Gateway.

  • CVSS V3 rated as Critical - 9.8 severity.
  • CVSS V2 rated as Critical - 10 severity.
    • Solution
    Customers are advised to upgrade to Barracuda Email Security Gateway version 9.2.0.008 or later to remediate the vulnerability.

    Impacted customers should discontinue the use of the compromised ESG appliance and contact Barracuda support to obtain a new ESG virtual or hardware appliance.

    Users are also being advised to rotate any applicable credentials connected to the ESG appliance:
    Any connected LDAP or AD
    Barracuda Cloud Control
    FTP Server
    SMB
    Any private TLS certificates

    For more information pertaining to this vulnerability please refer Barracuda Security Advisory.

    Vendor References

    CVEs related to QID 150701

    CVE-2023-2868 |
    Software Advisories
    Advisory ID Software Component Link
    BNSF-36456 BNSF-36456 BNSF-36456 URL Logo www.barracuda.com/company/legal/esg-vulnerability
    By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].