CVE-2020-7247
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2020-7247
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the "uncommented" default configuration. The issue exists because of an incorrect return value upon failure of input validation.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Openbsd Opensmtpd代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Openbsd Opensmtpd是Openbsd组织的一个基于RFC 5321的SMTP服务端软件。 Openbsd Opensmtpd 存在代码问题漏洞。远程攻击者可通过特制的SMTP session利用该漏洞以root权限执行任意命令。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
II. Public POCs for CVE-2020-7247
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | Python exploit of cve-2020-7247 | https://github.com/FiroSolutions/cve-2020-7247-exploit | POC Details |
| 2 | OpenSMTPD version 6.6.2 remote code execution exploit | https://github.com/superzerosec/cve-2020-7247 | POC Details |
| 3 | Proof Of Concept Exploit for CVE-2020-7247 (Remote Execution on OpenSMTPD < 6.6.2 | https://github.com/r0lh/CVE-2020-7247 | POC Details |
| 4 | OpenSMTPD 6.4.0 - 6.6.1 Remote Code Execution PoC exploit | https://github.com/QTranspose/CVE-2020-7247-exploit | POC Details |
| 5 | This vulnerability exists in OpenBSD’s mail server OpenSMTPD’s “smtp_mailaddr()” function, and affects OpenBSD version 6.6. This allows an attacker to execute arbitrary shell commands like “sleep 66” as root user | https://github.com/bytescrappers/CVE-2020-7247 | POC Details |
| 6 | PoC exploit for CVE-2020-7247 OpenSMTPD 6.4.0 < 6.6.1 Remote Code Execution | https://github.com/f4T1H21/CVE-2020-7247 | POC Details |
| 7 | Proof of concept for CVE-2020-7247 for educational purposes. | https://github.com/SimonSchoeni/CVE-2020-7247-POC | POC Details |
| 8 | Worm written in python, abuses CVE-2020-7247 | https://github.com/presentdaypresenttime/shai_hulud | POC Details |
| 9 | CVE-2020-7247 Remote Code Execution POC | https://github.com/gatariee/CVE-2020-7247 | POC Details |
| 10 | None | https://github.com/minhluannguyen/CVE-2020-7247-reproducer | POC Details |
| 11 | OpenSMTPD versions 6.4.0 - 6.6.1 are susceptible to remote code execution. smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the "uncommented" default configuration. The issue exists because of an incorrect return value upon failure of input validation. | https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2020/CVE-2020-7247.yaml | POC Details |
| 12 | None | https://github.com/Threekiii/Awesome-POC/blob/master/%E4%B8%AD%E9%97%B4%E4%BB%B6%E6%BC%8F%E6%B4%9E/OpenSMTPD%20%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%20CVE-2020-7247.md | POC Details |
| 13 | https://github.com/vulhub/vulhub/blob/master/opensmtpd/CVE-2020-7247/README.md | POC Details |
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2020-7247
请登录查看更多情报信息。
- https://www.openbsd.org/security.htmlx_refsource_CONFIRM
- http://www.openwall.com/lists/oss-security/2020/01/28/3x_refsource_MISC
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPH4QU4DNVHA7ACFXMYFCEP5PSXXPN4E/vendor-advisoryx_refsource_FEDORA
- https://nvd.nist.gov/vuln/detail/CVE-2020-7247
Same Patch Batch · n/a · 2020-01-29 · 28 CVEs total
| CVE-2019-18634 | Sudo 缓冲区错误漏洞 | |
| CVE-2019-20215 | D-Link DIR-859 操作系统命令注入漏洞 | |
| CVE-2019-20216 | D-Link DIR-859 操作系统命令注入漏洞 | |
| CVE-2019-20217 | D-Link DIR-859 操作系统命令注入漏洞 | |
| CVE-2020-7965 | Webargs 跨站请求伪造漏洞 | |
| CVE-2012-5776 | Dokeos 跨站脚本漏洞 | |
| CVE-2019-7654 | Wowza Media Systems Streaming Engine 跨站请求伪造漏洞 | |
| CVE-2019-7656 | Wowza Media Systems Streaming Engine 跨站脚本漏洞 | |
| CVE-2019-7655 | Wowza Media Systems Streaming Engine 跨站脚本漏洞 | |
| CVE-2020-8416 | BearFTP 资源管理错误漏洞 | |
| CVE-2013-2567 | Zavio IP Cameras 信任管理问题漏洞 | |
| CVE-2013-2568 | Zavio IP Cameras 操作系统命令注入漏洞 | |
| CVE-2013-2569 | Zavio IP Cameras 授权问题漏洞 | |
| CVE-2013-3215 | Vtiger CRM 授权问题漏洞 | |
| CVE-2020-8438 | Ruckus ZoneFlex R500 操作系统命令注入漏洞 | |
| CVE-2013-2570 | Zavio IP Cameras 操作系统命令注入漏洞 | |
| CVE-2013-2572 | 多款TP-LINK产品信任管理问题漏洞 | |
| CVE-2013-2573 | TP-LINK IP Cameras TL-SC 3130G、3171G和4171G 操作系统命令注入漏洞 | |
| CVE-2020-8432 | Das U-Boot 资源管理错误漏洞 | |
| CVE-2013-2574 | FOSCAM IP-Camera 安全漏洞 |
Showing top 20 of 28 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
V. Comments for CVE-2020-7247
No comments yet