CVE-2016-1000282: Command Injection Vulnerability in Haraka
Summary
CVE-2016-1000282: Critical severity vulnerability that affects Haraka. Affects Haraka versions < 2.8.9. Fixed in 2.8.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Haraka is an npm package that provides a scalable and plugin-oriented SMTP server framework. It is designed to be easy to extend and customize for various email processing needs. The package includes a plugin for processing attachments in zip files. Versions 2.8.8 and earlier of Haraka are affected by a critical command injection vulnerability.
Vulnerability Detail
The command injection vulnerability in Haraka allows an attacker to execute arbitrary commands on the server hosting the SMTP service. This vulnerability exists in the plugin responsible for processing attachments in zip files. By crafting a malicious zip file with specially crafted filenames, an attacker can inject arbitrary commands that will be executed when the zip file is processed. This can lead to unauthorized access, data leakage, and potential compromise of the server.
How To Fix
Minimum fixed version
2.8.9
This is the first release that contains the fix.
npm install Haraka@2.8.9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the fix by upgrading to the latest version of Haraka.
Conclusion
The command injection vulnerability in Haraka can have severe consequences, including unauthorized access and compromise of the server. It is crucial to upgrade to the latest version of Haraka (2.8.9 or later) to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Haraka →
FAQ
Haraka is an npm package that provides a scalable and plugin-oriented SMTP server framework.
The vulnerability allows an attacker to execute arbitrary commands on the server hosting the SMTP service, potentially leading to unauthorized access and compromise of the server.
Versions 2.8.8 and earlier of Haraka are affected by this vulnerability.
To fix this vulnerability, upgrade to Haraka version 2.8.9 or later.
No, there is no known workaround. It is essential to upgrade to the latest version of Haraka.
References
Related vulnerabilities
Recent vulnerabilities recorded for Haraka.
