CVE-2025-52691

SmarterMail Unauthenticated Arbitrary File Upload RCE

Overview

Critical unauthenticated arbitrary file upload allowing remote code execution.

Attack Flow

flowchart LR
    A[Attacker] --> B["Find Upload Endpoint"]
    B --> C["/api/upload"]
    C --> D["Upload ASPX Shell"]
    D --> E["Path Traversal"]
    E --> F["../wwwroot/"]
    F --> G["Access Shell"]
    G --> H["RCE as IIS User"]

Technical Details

The vulnerability allows unauthenticated attackers to upload arbitrary files to any server location. By uploading an ASPX webshell to the webroot, attackers achieve code execution.

Attack Steps:

1. Upload ASPX webshell via vulnerable endpoint
2. Use path traversal to write to wwwroot
3. Access uploaded shell via HTTP
4. Execute arbitrary commands

Usage

python exploit.py https://mail.target.com

python exploit.py https://mail.target.com -c "whoami"

python exploit.py https://mail.target.com -c "net user"

Parameters

Requirements

requests

Mitigation

• Update to SmarterMail Build 9413 or later
• Restrict access to management interfaces
• Implement WAF rules

Disclaimer

For authorized security testing only.