oss-sec mailing list archives

https://blog.calif.io/p/we-asked-claude-to-audit-sagredos and
https://github.com/califio/publications/tree/main/MADBugs/qmail
disclose CVE-2026-41113 in the version of qmail from
https://github.com/sagredo-dev/qmail .

qmail-remote RCE via DNS MX Hostname Shell Injection (CVE-2026-41113)

Remote code execution in sagredo-dev/qmail through shell injection in
tls_quit(). An attacker who controls DNS for any domain the target server
sends mail to can execute arbitrary commands as the qmailr user.

Affected        sagredo-dev/qmail v2024.10.26 through v2026.04.02
Fixed in        v2026.04.07 (commit 749f607)
Requirement     control/notlshosts_auto enabled
CVSS 3.1        8.2 High (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVE             CVE-2026-41113

Our system zeroed in on a feature called notlshosts_auto that was added in
October 2024. The idea behind it is reasonable: when qmail tries to deliver
mail and the remote server's TLS is broken, you don't want to retry TLS
forever, so this feature automatically remembers the bad host by creating a
marker file named after it, and future deliveries skip TLS for that host.
The implementation lives in qmail-remote.c, inside the TLS error handler
tls_quit():

    sprintf(acfcommand, "/bin/touch %s/control/notlshosts/'%s'",
            info->pw_dir, partner_fqdn);
    fp = popen(acfcommand, "r");

It builds a shell command containing the remote hostname and runs it with
popen(). The author wrapped the hostname in single quotes, presumably
thinking that neutralizes shell metacharacters, but that protection fails
the moment the hostname contains a single quote of its own.

The obvious objection is that hostnames can't contain single quotes, and
that's true of host names in the RFC 952 sense, but it is not true of DNS
labels. On the wire, a DNS label is just a length byte followed by up to
63 arbitrary bytes; RFC 1035 lets you put nearly anything in there, and
most recursive resolvers will happily pass it through. When qmail calls
glibc's dn_expand() to decode an MX record, some special characters get
escaped, but ', `, |, &, <, and > come through untouched. The net result
is that partner_fqdn, the string being pasted into a shell command, is
attacker-controlled via DNS.

Further details about how the bug was found are provided in the blog,
while the github repo provides PoC setup & exploit code.

--
        -Alan Coopersmith-                 alan.coopersmith () oracle com
         Oracle Solaris Engineering - https://blogs.oracle.com/solaris

Current thread:

• CVE-2026-41113: RCE in sagredo fork of qmail Alan Coopersmith (Apr 18)