CVE-2024-35179 Unprivileged Stalwart Mail Server user can read files as root
Unprivileged admins can read arbitrary files as root when RUN_AS_USER is configured, enabling privilege escalation and data exposure.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-35179?
CVE-2024-35179 is a medium-severity vulnerability in stalwartlabs mail-server, published on 15 May 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Stalwart Mail Server is an open-source mail server. Prior to version 0.8.0, when using `RUN_AS_USER`, the specified user (and therefore, web interface admins) can read arbitrary files as root. This issue affects admins who have set up to run stalwart with `RUN_AS_USER` who handed out admin credentials to the mail server but expect these to only grant access according to the `RUN_AS_USER` and are attacked where the attackers managed to achieve Arbitrary Code Execution using another vulnerability. Version 0.8.0 contains a patch for the issue.
Weakness: CWE-271
Which versions are affected by CVE-2024-35179?
How do I fix CVE-2024-35179?
No fix has been published for CVE-2024-35179 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-35179 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-35179 exists.
Sources
Also known as GHSA-5pfx-j27j-4c6h.