Forged LFT metadata permits arbitrary file read and deletion

Summary

SEPPmail Secure Email Gateway before 15.1.1 trusts a file path supplied in externally provided Large File Transfer attachment metadata. An unauthenticated remote sender can cause the mail-processing worker to disclose, move, or delete an accessible regular file when LFT is enabled and the message reaches an affected secure-mail processing path. The validated workers ran as root.

Remediation

1. Inventory every SEPPmail AG SEPPmail Secure Email Gateway (SEG) deployment, including staging.
2. Upgrade SEPPmail AG SEPPmail Secure Email Gateway (SEG) to 15.1.1.
3. Confirm the running version after the upgrade.

References

• Referencehttps://docs.seppmail.com/en/20_revision-history.html