Code execution through double evaluation in address replacement rules

Summary

SEPPmail Secure Email Gateway before 15.1.1 can evaluate attacker-influenced replacement text as Perl code in sender or recipient replacement rules. An unauthenticated remote sender can execute operating-system commands in the mail-processing worker context when an active rule uses message-derived replacement data and its search condition matches. The validated worker context was root.

Remediation

1. Inventory every SEPPmail AG SEPPmail Secure Email Gateway (SEG) deployment, including staging.
2. Upgrade SEPPmail AG SEPPmail Secure Email Gateway (SEG) to 15.1.1.
3. Confirm the running version after the upgrade.

References

• Referencehttps://docs.seppmail.com/en/20_revision-history.html