solmin111/opensmtpd-cve-2020-7247-Docker-based lab demonstrating CVE-2020-7247 remote code execution in OpenSMTPD 6.6.1p1 with a Python PoC for educational security testing.
WHS 4th Park Solmin
Original link: https://github.com/vulhub/vulhub/blob/43eae7170d09e7748c3aac64cd6a8e5af508a8ef/opensmtpd/CVE-2020-7247/README.md
OpenSMTPD is an SMTP server program used on Unix-like operating systems. It can be used on BSD, macOS, GNU/Linux, etc., and operates based on the RFC 5321 SMTP protocol.
CVE-2020-7247 is a remote command execution vulnerability in OpenSMTPD caused by insufficient validation of sender or recipient addresses. An attacker can send a crafted SMTP request to execute arbitrary commands on the server.
This vulnerability was patched in OpenSMTPD version 6.6.2p1.
| Item | Content |
|---|
| Vulnerability ID | CVE-2020-7247 |
| Vulnerable Software | OpenSMTPD |
| Vulnerable Version | OpenSMTPD 6.6.1p1 |
| Vulnerability Type | Remote Code Execution |
| Lab Environment | Docker / Vulhub |
| Port Used | 8825:25 |
Run the vulnerable OpenSMTPD environment using the following command.
docker compose up -d
Verify that the container is running properly.
docker compose ps
Connect to port 8825 to check that the SMTP service is working.
nc 127.0.0.1 8825 -v
If connected successfully, the OpenSMTPD banner will be displayed as follows.
220 <container-id> ESMTP OpenSMTPD
Use the PoC code to send a command to the target server. In this lab, a command to create a /tmp/proof.txt file was used instead of a dangerous command.
python3 poc.py 127.0.0.1 8825 'touch /tmp/proof.txt'
Then check if the file was created inside the container.
docker compose exec smtpd ls -l /tmp/proof.txt
If the /tmp/proof.txt file is found, it means the command sent from outside was executed inside the container.
It was confirmed that if input validation is insufficient during OpenSMTPD's SMTP request processing, an attacker can execute arbitrary commands on the server through crafted requests.
This lab was conducted only in a local Docker environment and should not be performed against real servers or unauthorized systems.