CVE-2023-2868: Barracuda Networks exploited

Advisory generated from the CVE record, CISA, Exploit Observer and VEDAS: what it is, whether it is exploited, who is affected, and how to fix and detect it.

What it is

A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar file (tape archives). The vulnerability stems from incomplete input validation of a user-supplied .tar file as it pertains to the names of the files contained within the archive. As a consequence, a remote attacker can specifically format these file names in a particular manner that will result in remotely executing a system command through Perl’s qx operator with the privileges of the Email Security Gateway product. This issue was fixed as part of BNSF-36456 patch. This patch was automatically applied to all customer appliances.

Description quoted from the CVE record (assigned by Google, published 2023-05-24).

Weakness: CWE-20 Improper Input Validation

How it can be exploited

Exploitable over the network with low attack complexity needing no privileges and no user interaction. Impact: confidentiality high, integrity high, availability low. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

CISA assessment (SSVC): CISA assesses exploitation as active. Automatable: yes. Technical impact: total.

On CISA KEV since: 2023-05-26
US federal deadline: 2023-06-16
Ransomware use: Not known

Public exploit evidence (Exploit Observer)

Exploit Observer found 5 code repositories and 2 research write-ups naming this CVE.

AttackerKB analysis

Code repositories that name a CVE are often scanners, copies or fakes, and some are malware. Read the code before running anything.

See all 13 references on Exploit Observer

Live scores

EPSS: 0.868
very likely to be attacked soon
VEDAS: 0.980
strong exploit evidence
On CISA KEV: Yes, since 2023-05-26
Detection rule: No public rule yet

EPSS (chance of attack)

VEDAS (exploit evidence)

Thin horizontal line: the “likely exploited” threshold (EPSS 0.10, VEDAS 0.5). Shaded “no data” areas are periods when cve-scores did not publish.

Who is affected

Product	Affected	Not affected
Barracuda Email Security Gateway	from 5.1.3.001 before 9.2.0.006	Not stated

Version ranges exactly as the CVE record states them. “Before X” means X is the first fixed version.

How to fix it

Fixed versions stated in the CVE record: 9.2.0.006.

CISA required action: Apply updates per vendor instructions.

Vendor guidance:

How to detect it

There is no open VEDAS detection rule for this bug yet. It is listed on the detection gaps page if CISA has confirmed attacks.

Advisories on this CVE

Barracuda warns of critical flaws that chain to root access on Email Security Gateway and other appliances (full advisory)

References

Government sources

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-2868 (government-resource)

Other references

Other databases

Where this comes from

This advisory is generated automatically by VEDAS from: CVE.org record, CISA KEV, cve-scores (EPSS and VEDAS), Exploit Observer. Text in quotes is reproduced from the source; everything else is a fixed template filled with source fields. Nothing here is written by a language model. Check the vendor advisory before acting, and read how VEDAS and Exploit Observer work, and their limits.