Security advisory: multiple vulnerabilities including Pre-authentication root RCE in Xeams 10.3 build 6449 (Synametrics Technologies)
disclosure via Fulldisclosure ·
0day Rubbish Research Team is publicly disclosing 2 vulnerabilities in Xeams 10.3 build 6449 (Synametrics Technologies). The research is published and a proof-of-concept is available. Vulnerability 1: Pre-authentication root RCE (CVSS 9.8, pre-authentication) A framework-level debug write primitive in the rules engine reads an attacker-controlled MIME header, X-SM_SAVE_BODY_4DEBUGGING, as an absolute file path and the message body as the file content, writing to any path on the host with no validation, no allowlist, and no authentication gate. The SMTP service accepts unauthenticated delivery by default (reqAuthForLocal=false is the global default). When Xeams runs as root, an attacker writes a cron job into /etc/cron.d/, which crond executes as root every minute, yielding a complete unauthenticated root RCE. The entire chain depends only on SMTP, requires no HTTP and no credentials, and was dynamically verified on both port 25 and port 587 producing uid=0(root). Impact: Arbitrary root command execution on the mail server host, full root read of the Xeams mail repository (all .eml envelope/subject/body), and complete control of the Xeams process; no credentials required. Advisory: https://0day-rubbish.com/blog/xeams-smtp-savebody-cron-rce Vulnerability 2: Pre-authentication root RCE (CVSS 9.8, pre-authentication) The built-in SQLRunner.jsp administrative page is directly reachable without authentication: web.xml declares no security-constraint for JSPs, the SynaFilter maps only /FrontController/*, and NewPageHeader.jsp does not enforce authentication. Directly requesting SQLRunner.jsp bypasses the FrontController dispatch, the SynaFilter, and the operation-level authorization. The operation=1 branch performs no auth check and connects to the embedded Derby database using attacker-supplied credentials; Xeams hardcodes the Derby database-owner credentials system/manager, so an attacker reuses them. With the JDBC connection stored in the HTTP session, operation=2 issues arbitrary SQL, and calling the Derby procedure SYSCS_UTIL.SYSCS_EXPORT_QUERY writes an attacker-controlled JSP webshell into the Tomcat webapps/ROOT docBase. A subsequent GET triggers Jasper on-demand compilation and execution, yielding arbitrary command execution at the Xeams process privilege (root in the default deployment). The chain requires only HTTP access to the Xeams web port (default 5272/TCP), no valid login, no CSRF token, and no prior session. The RCE was dynamically verified end-to-end producing uid=0(root). Impact: Arbitrary command execution on the mail server host at the Xeams process privilege (root in the default deployment), full read of the Xeams mail repository and the host filesystem, and complete control of the Xeams process and embedded Derby database. Advisory: https://0day-rubbish.com/blog/xeams-unauth-sqlrunner-derby-jsp-rce PoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish -- 0day Rubbish Research Team https://0day-rubbish.com _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/