CVE-2023-27582 Full authentication bypass if SASL authorization username is specified
Attackers can bypass authentication in maddy mail server by specifying a SASL authorization username, gaining unauthorized access to accounts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-27582?
CVE-2023-27582 is a critical authentication bypass vulnerability in foxcpp maddy, published on 13 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
maddy is a composable, all-in-one mail server. Starting with version 0.2.0 and prior to version 0.6.3, maddy allows a full authentication bypass if SASL authorization username is specified when using the PLAIN authentication mechanisms. Instead of validating the specified username, it is accepted as is after checking the credentials for the authentication username. maddy 0.6.3 includes the fix for the bug. There are no known workarounds.
Which versions are affected by CVE-2023-27582?
3 open source packages ship an affected version, including github.com/foxcpp/maddy. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/foxcpp/maddy Go | From 0.2.0 | 0.6.3 |
github.com/foxcpp/maddy Go | From 0.2.0 | 0.6.3 |
github.com/foxcpp/maddy Go | From 0.2.0 | 0.6.3 |
Products include Maddy Project Maddy.
How do I fix CVE-2023-27582?
Upgrade github.com/foxcpp/maddy to 0.6.3 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-27582 being exploited?
There is no known exploitation of CVE-2023-27582 in the wild and no public exploit code.
Other vulnerabilities in foxcpp maddy
Sources
Also known as GHSA-4g76-w3xw-2x6w, GO-2023-1630.