Skip to content
Fencer Intel
high 8.8

CVE-2017-7692 in the critical feed json

SquirrelMail 1.4.22 (and other versions before 20170427_0200-SVN) allows post-authentication remote code execution via a sendmail.cf file t…

published 2017-04-20 9 y ago modified 2026-06-17 4 mo ago also EUVD-2017-16668

cvss
8.8
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
32.2%
EPSS 32.2% chance of exploitation in 30 days, percentile 98%
public exploits
1
Exploit-DB

Summary

SquirrelMail 1.4.22 (and other versions before 20170427_0200-SVN) allows post-authentication remote code execution via a sendmail.cf file that is mishandled in a popen call. It's possible to exploit this vulnerability to execute arbitrary shell commands on the remote server. The problem is in the Deliver_SendMail.class.php with the initStream function that uses escapeshellcmd() to sanitize the sendmail command before executing it. The use of escapeshellcmd() is not correct in this case since it doesn't escape whitespaces, allowing the injection of arbitrary command parameters. The problem is in -f$envelopefrom within the sendmail command line. Hence, if the target server uses sendmail and SquirrelMail is configured to use it as a command-line program, it's possible to trick sendmail into using an attacker-provided configuration file that triggers the execution of an arbitrary command. For exploitation, the attacker must upload a sendmail.cf file as an email attachment, and inject the sendmail.cf filename with the -C option within the "Options > Personal Informations > Email Address" setting.

Patch / fix

  • squirrelmail Ubuntu 14.04 LTS 2:1.4.23~svn20120406-2+deb8u1build0.14.04.1
  • squirrelmail Ubuntu 16.04 LTS 2:1.4.23~svn20120406-2+deb8u1ubuntu0.16.04.1

ubuntu advisories UBUNTU-CVE-2017-7692

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2017-7692 updated cvss 7.5

squirrelmail: Insufficient escaping of user-supplied data

  • Red Hat Enterprise Linux 5 squirrelmail
    affected: no fix planned “Will not fix”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. Published
  2. First public exploit (EDB-41910)

Exploit prediction

32.16% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • EDB-41910 SquirrelMail < 1.4.22 - Remote Code Execution remote, 2017-04-23
  • legalhackers.com https://legalhackers.com/advisories/SquirrelMail-Exploit-Remote-Code-Exec-CVE-2017-7692-Vuln.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.0 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 9.0 AV:N/AC:L/Au:S/C:C/I:C/A:C

Classification

Weakness
  • CWE-20 Improper Input Validation

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.