Loading vulnerability…
CVE-2023-2868 is a remote command injection vulnerability affecting the appliance form factor of Barracuda Email Security Gateway (ESG), versions 5.1.3.001 through 9.2.0.006. Incomplete validation of archive member filenames during TAR attachment processing in the Amavis antivirus scanning module allows specially crafted filenames to execute system commands through Perl's qx operator with ESG product privileges. Exploitation occurs when the appliance scans an incoming malicious attachment and requires neither authentication nor recipient interaction. The vulnerability was exploited as a zero day as early as October 2022.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository contains a proof-of-concept exploit for CVE-2023-2868, a command injection vulnerability in Barracuda Email Security Gateway (ESG) appliances. The repository consists of a Ruby script ('poc_cve_2023_2868.rb') and a README file. The exploit works by crafting a malicious tar archive containing a file with a payload that, when processed by the vulnerable ESG, executes a shell command to establish a reverse shell to the attacker's machine using OpenSSL. The script sends the malicious tar file as an email attachment to the target ESG via SMTP. The attacker must specify the target's IP address (RHOST) and have a listener running on their own machine (LHOST:LPORT) to receive the shell. The exploit demonstrates a full attack chain, including payload generation, archive creation, email delivery, and cleanup. The code is operational and can be used to gain remote shell access to vulnerable Barracuda ESG devices.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
40 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A vulnerability in Barracuda Email Security Gateway appliances exploited by UNC4841 to deploy persistent backdoors. It is cited as historical context for attacks targeting email security gateways; its technical mechanism is not described.
A vulnerability in Barracuda Email Security Gateway appliances exploited by UNC4841 in 2023 to deliver persistent backdoors. It is mentioned as historical context for threats targeting secure email gateways, not as part of the current Linux backdoor activity.
A CVE mentioned only as a historical, unrelated incident associated with the hosting provider ASN; the article does not describe the vulnerability, affected product, exploitation details, or any connection to CRPX0 activity.
A filename parsing vulnerability mentioned only as a comparison point to a separate campaign that delivered VShell.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.