[<prev] [day] [month] [year] [list]
Message-ID: <40a3cde4-06d8-4c9a-8884-df8f4cd10910@oracle.com>
Date: Sat, 18 Apr 2026 12:10:17 -0700
From: Alan Coopersmith <alan.coopersmith@...cle.com>
To: oss-security@...ts.openwall.com
Subject: CVE-2026-41113: RCE in sagredo fork of qmail
https://blog.calif.io/p/we-asked-claude-to-audit-sagredos and
https://github.com/califio/publications/tree/main/MADBugs/qmail
disclose CVE-2026-41113 in the version of qmail from
https://github.com/sagredo-dev/qmail .
> qmail-remote RCE via DNS MX Hostname Shell Injection (CVE-2026-41113)
>
> Remote code execution in sagredo-dev/qmail through shell injection in
> tls_quit(). An attacker who controls DNS for any domain the target server
> sends mail to can execute arbitrary commands as the qmailr user.
>
> Affected sagredo-dev/qmail v2024.10.26 through v2026.04.02
> Fixed in v2026.04.07 (commit 749f607)
> Requirement control/notlshosts_auto enabled
> CVSS 3.1 8.2 High (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
> CVE CVE-2026-41113
> Our system zeroed in on a feature called notlshosts_auto that was added in
> October 2024. The idea behind it is reasonable: when qmail tries to deliver
> mail and the remote server's TLS is broken, you don't want to retry TLS
> forever, so this feature automatically remembers the bad host by creating a
> marker file named after it, and future deliveries skip TLS for that host.
> The implementation lives in qmail-remote.c, inside the TLS error handler
> tls_quit():
>
> sprintf(acfcommand, "/bin/touch %s/control/notlshosts/'%s'",
> info->pw_dir, partner_fqdn);
> fp = popen(acfcommand, "r");
>
> It builds a shell command containing the remote hostname and runs it with
> popen(). The author wrapped the hostname in single quotes, presumably
> thinking that neutralizes shell metacharacters, but that protection fails
> the moment the hostname contains a single quote of its own.
>
> The obvious objection is that hostnames can't contain single quotes, and
> that's true of host names in the RFC 952 sense, but it is not true of DNS
> labels. On the wire, a DNS label is just a length byte followed by up to
> 63 arbitrary bytes; RFC 1035 lets you put nearly anything in there, and
> most recursive resolvers will happily pass it through. When qmail calls
> glibc's dn_expand() to decode an MX record, some special characters get
> escaped, but ', `, |, &, <, and > come through untouched. The net result
> is that partner_fqdn, the string being pasted into a shell command, is
> attacker-controlled via DNS.
Further details about how the bug was found are provided in the blog,
while the github repo provides PoC setup & exploit code.
--
-Alan Coopersmith- alan.coopersmith@...cle.com
Oracle Solaris Engineering - https://blogs.oracle.com/solaris
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
