SmarterMail Authentication Bypass Vulnerability Exploited in the Wild
A recently discovered authentication bypass vulnerability in SmarterMail, a self-hosted Windows email server and collaboration platform, is being actively exploited by hackers to hijack admin accounts. The vulnerability, which does not have a CVE identifier, affects the 'force-reset-password' API endpoint, allowing unauthenticated attackers to reset the system administrator password and gain full privileges. This issue is particularly concerning as SmarterMail is widely used by managed service providers, small and medium-sized businesses, and hosting providers offering email services, with over 15 million users in 120 countries. The vulnerability was first reported by researchers at watchTowr on January 8, and a fix was released by SmarterMail on January 15. However, despite the fix, threat actors have managed to reverse-engineer the patch and are now exploiting the flaw in the wild.
The technical explanation of the vulnerability lies in the 'force-reset-password' API endpoint, which accepts attacker-controlled JSON input, including a 'IsSysAdmin' bool type property. If set to 'true', this property forces the backend to execute the system administrator password reset logic without performing any security controls or verifying the old password. As a result, anyone who knows or guesses an admin username could set a new password and hijack the account. The researchers at watchTowr have created a proof-of-concept exploit that demonstrates SYSTEM-level shell access, highlighting the severity of the vulnerability. With admin-level access, attackers can run OS commands, thus getting full remote code execution on the host. The exploitation chain involves sending a malicious request to the 'force-reset-password' endpoint, which then allows the attacker to reset the admin password and gain access to the system.
The exploitation of this vulnerability has significant strategic implications, as it allows attackers to gain full control over the SmarterMail system, potentially leading to data breaches, email account takeovers, and other malicious activities. The fact that the vulnerability is being actively exploited in the wild, despite the availability of a patch, highlights the importance of prompt patch management and security best practices. Users of SmarterMail are recommended to upgrade to the latest version of the software, Build 9511, released on January 15, which addresses both this issue and a previously discovered critical pre-auth RCE flaw. Additionally, organizations should monitor their systems for suspicious activity, such as unexpected password resets or login attempts, and implement additional security measures, such as multi-factor authentication and regular security audits, to prevent similar attacks in the future.
Attack Surface
Email, Server OS
Tactics
Initial Access, Privilege Escalation, Execution
Techniques
- T1068 – Exploitation for Privilege Escalation
- T1072 – Software Deployment Tools
SuperPRO's Threat Countermeasures Procedures
- Upgrade SmarterMail to the latest version, Build 9511, released on January 15, which addresses both this issue and a previously discovered critical pre-auth RCE flaw
- Implement multi-factor authentication to prevent attackers from gaining access to the system even if they manage to reset the admin password
- Monitor the system for suspicious activity, such as unexpected password resets or login attempts, and investigate any unusual behavior
- Regularly perform security audits to identify and address potential vulnerabilities in the system
- Use a web application firewall (WAF) to detect and prevent malicious requests to the 'force-reset-password' endpoint
- Limit access to the SmarterMail system to only trusted users and IP addresses
- Enable logging and monitoring of all system activity to detect and respond to potential security incidents