Summary
Lumisoft MailServer is extensively using deserialization of user supplied data into a DataSet object.
Microsoft recently released a security patch CVE-2020-1147 to limit the impact of reading untrusted XML into a DataSet. However its official statement is:
The DataSet.ReadXml and DataTable.ReadXml methods are not safe when used with untrusted input. We strongly recommend that consumers instead consider using one of the alternatives outlined later in this document. …and… .NET has released security updates to mitigate some issues such as information disclosure or remote code execution in DataSet.ReadXml and DataTable.ReadXml. The .NET security updates may not provide complete protection against these threat categories. Consumers should assess their individual scenarios and consider their potential exposure to these risks.
Product
Lumisoft Mail Server
Tested Version
The latest development snapshot to the date from downloads section.
Details
Issue 1: Deserialization of user supplied data in MonitoringServerSession.UpdateSettings
Lumisoft MailServer is listening on all network interfaces on port 5252 for incoming connections. The default configuration allows only localhost connections.
One of the supported unauthenticated commands is UPDATESETTINGS in a form of:
UPDATESETTINGS <virtualServerID> <dataLength><CRLF><xml> that is handled by the following code:
MemoryStream ms = new MemoryStream();
this.TcpStream.ReadFixedCount(ms,Convert.ToInt32(args[1]));
ms.Position = 0;
DataSet ds = new DataSet();
...
ds.ReadXml(ms);
Impact
This issue may lead to pre-auth Remote Code Execution (RCE). If the endpoint is not accessible from remote addresses and the server is running as a privileged process it may lead to Local Privilege Escalation (LPE).
Issue 2: Unsafe deserialization of data returned by the server
Lumisoft User API libraries deserialize data returned from a server in multiple places like Utils.DecompressDataSet, RecyleBin.Bind, System_Settings.Bind, etc.
Impact
This issue may lead to pre-auth Remote Code Execution (RCE) on the client side in a Person in the Middle (PitM) scenario or if the user is tricked into connecting to a malicious server.
Coordinated Disclosure Timeline
- 2020-07-21: Report sent to maintainer. No reply.
- 2020-07-28: Notification sent to maintainer.
- 2020-10-19: 90 days from when the report was sent, disclosure deadline expires.
- 2020-10-29: Notification sent to maintainer.
Credit
This issue was discovered and reported by GHSL team member @JarLob (Jaroslav Lobačevski).
Contact
You can contact the GHSL team at securitylab@github.com, please include a reference to GHSL-2020-137 in any communication regarding this issue.