CVE-2020-28007: Exim Privilege Escalation Vulnerability

CVE-2020-28007 Overview

CVE-2020-28007 is a local privilege escalation vulnerability in Exim mail transfer agent versions prior to 4.94.2. The vulnerability exists because Exim operates with root privileges when accessing the log directory, which is owned by a non-root user. This privilege mismatch creates a security gap that allows attackers to exploit symlink or hard link attacks to overwrite critical root-owned files anywhere on the filesystem.

Critical Impact

Local attackers with limited privileges can leverage this vulnerability to overwrite arbitrary root-owned files, potentially leading to complete system compromise, privilege escalation to root, or denial of service by corrupting essential system files.

Affected Products

• Exim versions prior to 4.94.2
• All Exim 4.x installations running with default log directory configurations
• Linux/Unix systems running vulnerable Exim mail server deployments

Discovery Timeline

• 2021-05-06 - CVE-2020-28007 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-28007

Vulnerability Analysis

This vulnerability stems from improper privilege handling in Exim's log directory operations. Exim, as a mail transfer agent, requires elevated privileges to perform certain operations. However, the design flaw lies in how Exim handles the log directory: while the directory itself is owned by a non-root user (typically the exim user), Exim operates with root privileges when writing to files within this directory.

This architectural weakness creates a race condition opportunity where an attacker with local access and permissions to the log directory can create symbolic links or hard links pointing to sensitive root-owned files elsewhere on the filesystem. When Exim subsequently writes log data, it follows these links and overwrites the target files with root privileges, effectively allowing arbitrary file overwrites as root.

The vulnerability is classified under CWE-59 (Improper Link Resolution Before File Access), commonly known as a "link following" vulnerability.

Root Cause

The root cause is Exim's failure to properly validate file paths and detect symbolic or hard links before performing write operations in the log directory. The privilege separation model is flawed—Exim retains root privileges during log operations in a directory that less-privileged users can manipulate.

Specifically:

• The log directory is owned by a non-privileged user (e.g., exim or mail)
• Exim operates as root when writing to this directory
• No verification is performed to ensure the target file is not a symbolic or hard link
• An attacker controlling the log directory can redirect writes to arbitrary locations

Attack Vector

This is a local attack that requires the attacker to have local access to the system and write permissions to the Exim log directory. The attacker creates a malicious symlink or hard link in the log directory, pointing to a sensitive root-owned file such as /etc/passwd, /etc/shadow, or system binaries.

When Exim writes log data (which occurs during normal mail processing), it follows the link and overwrites the target file with log content. While the content written is log data rather than attacker-controlled data, strategic targeting can corrupt critical system files, potentially leading to denial of service or authentication bypass. In some scenarios, the attacker may be able to time the attack to inject specific content by controlling mail processing that generates predictable log entries.

For detailed technical analysis and exploitation mechanics, refer to the Exim CVE-2020-28007 Documentation.

Detection Methods for CVE-2020-28007

Indicators of Compromise

• Unexpected symbolic or hard links appearing in the Exim log directory (/var/log/exim/ or similar)
• Root-owned system files with unexpected modification timestamps correlating with Exim log activity
• Presence of log-like content in critical system files such as /etc/passwd or /etc/shadow
• File integrity monitoring alerts for sensitive system files

Detection Strategies

• Implement file integrity monitoring (FIM) on critical system files and the Exim log directory
• Monitor for symlink or hard link creation events in the Exim log directory using auditd rules
• Deploy behavioral analysis to detect unusual file operations by the Exim process
• Review Exim process file access patterns for writes outside expected log file paths

Monitoring Recommendations

• Configure auditd to monitor the Exim log directory for link creation events
• Enable SentinelOne's behavioral AI to detect suspicious privilege escalation patterns
• Set up alerts for any modification to root-owned files by the Exim process
• Regularly audit the Exim log directory for unexpected file types or links

How to Mitigate CVE-2020-28007

Immediate Actions Required

• Upgrade Exim to version 4.94.2 or later immediately
• Audit existing Exim log directories for suspicious symlinks or hard links
• Restrict permissions on the Exim log directory to prevent unauthorized link creation
• Consider running Exim with reduced privileges where possible

Patch Information

The vulnerability is addressed in Exim version 4.94.2 and later. The patch implements proper link resolution checks before file access operations in the log directory, preventing the exploitation of symlink and hard link attacks.

Administrators should obtain the patched version from official Exim distribution channels or their Linux distribution's package repositories. For detailed patch information, consult the Exim CVE-2020-28007 Documentation.

Workarounds

• Change the log directory ownership to root while maintaining appropriate group permissions for log access
• Mount the log directory with the nosymfollow option if supported by the filesystem
• Implement mandatory access control (SELinux/AppArmor) policies to restrict Exim's file access
• Monitor and restrict the creation of links in the Exim log directory using filesystem ACLs

# Configuration example - Restrict log directory permissions
# Change ownership to root:exim and restrict write access
chown root:exim /var/log/exim
chmod 750 /var/log/exim

# Enable auditd monitoring for link creation in log directory
auditctl -w /var/log/exim -p wa -k exim_log_monitor