CVE-2020-28007: Exim Privilege Escalation Vulnerability

CVE-2020-28007 Overview

CVE-2020-28007 is a local privilege escalation vulnerability in Exim mail transfer agent versions prior to 4.94.2. The vulnerability exists because Exim operates with root privileges when accessing the log directory, which is owned by a non-root user. This privilege mismatch creates a security gap that allows attackers to exploit symlink or hard link attacks to overwrite critical root-owned files anywhere on the filesystem.

Critical Impact
Local attackers with limited privileges can leverage this vulnerability to overwrite arbitrary root-owned files, potentially leading to complete system compromise, privilege escalation to root, or denial of service by corrupting essential system files.

Affected Products

Exim versions prior to 4.94.2
All Exim 4.x installations running with default log directory configurations
Linux/Unix systems running vulnerable Exim mail server deployments

Discovery Timeline

2021-05-06 - CVE-2020-28007 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-28007

Vulnerability Analysis

This vulnerability stems from improper privilege handling in Exim's log directory operations. Exim, as a mail transfer agent, requires elevated privileges to perform certain operations. However, the design flaw lies in how Exim handles the log directory: while the directory itself is owned by a non-root user (typically the exim user), Exim operates with root privileges when writing to files within this directory.

This architectural weakness creates a race condition opportunity where an attacker with local access and permissions to the log directory can create symbolic links or hard links pointing to sensitive root-owned files elsewhere on the filesystem. When Exim subsequently writes log data, it follows these links and overwrites the target files with root privileges, effectively allowing arbitrary file overwrites as root.

The vulnerability is classified under CWE-59 (Improper Link Resolution Before File Access), commonly known as a "link following" vulnerability.

Root Cause

The root cause is Exim's failure to properly validate file paths and detect symbolic or hard links before performing write operations in the log directory. The privilege separation model is flawed—Exim retains root privileges during log operations in a directory that less-privileged users can manipulate.

Specifically:

The log directory is owned by a non-privileged user (e.g., exim or mail)
Exim operates as root when writing to this directory
No verification is performed to ensure the target file is not a symbolic or hard link
An attacker controlling the log directory can redirect writes to arbitrary locations

Attack Vector

This is a local attack that requires the attacker to have local access to the system and write permissions to the Exim log directory. The attacker creates a malicious symlink or hard link in the log directory, pointing to a sensitive root-owned file such as /etc/passwd, /etc/shadow, or system binaries.

When Exim writes log data (which occurs during normal mail processing), it follows the link and overwrites the target file with log content. While the content written is log data rather than attacker-controlled data, strategic targeting can corrupt critical system files, potentially leading to denial of service or authentication bypass. In some scenarios, the attacker may be able to time the attack to inject specific content by controlling mail processing that generates predictable log entries.

For detailed technical analysis and exploitation mechanics, refer to the Exim CVE-2020-28007 Documentation.

Detection Methods for CVE-2020-28007

Indicators of Compromise

Unexpected symbolic or hard links appearing in the Exim log directory (/var/log/exim/ or similar)
Root-owned system files with unexpected modification timestamps correlating with Exim log activity
Presence of log-like content in critical system files such as /etc/passwd or /etc/shadow
File integrity monitoring alerts for sensitive system files

Detection Strategies

Implement file integrity monitoring (FIM) on critical system files and the Exim log directory
Monitor for symlink or hard link creation events in the Exim log directory using auditd rules
Deploy behavioral analysis to detect unusual file operations by the Exim process
Review Exim process file access patterns for writes outside expected log file paths

Monitoring Recommendations

Configure auditd to monitor the Exim log directory for link creation events
Enable SentinelOne's behavioral AI to detect suspicious privilege escalation patterns
Set up alerts for any modification to root-owned files by the Exim process
Regularly audit the Exim log directory for unexpected file types or links

How to Mitigate CVE-2020-28007

Immediate Actions Required

Upgrade Exim to version 4.94.2 or later immediately
Audit existing Exim log directories for suspicious symlinks or hard links
Restrict permissions on the Exim log directory to prevent unauthorized link creation
Consider running Exim with reduced privileges where possible

Patch Information

The vulnerability is addressed in Exim version 4.94.2 and later. The patch implements proper link resolution checks before file access operations in the log directory, preventing the exploitation of symlink and hard link attacks.

Administrators should obtain the patched version from official Exim distribution channels or their Linux distribution's package repositories. For detailed patch information, consult the Exim CVE-2020-28007 Documentation.

Workarounds

Change the log directory ownership to root while maintaining appropriate group permissions for log access
Mount the log directory with the nosymfollow option if supported by the filesystem
Implement mandatory access control (SELinux/AppArmor) policies to restrict Exim's file access
Monitor and restrict the creation of links in the Exim log directory using filesystem ACLs

bash

# Configuration example - Restrict log directory permissions
# Change ownership to root:exim and restrict write access
chown root:exim /var/log/exim
chmod 750 /var/log/exim

# Enable auditd monitoring for link creation in log directory
auditctl -w /var/log/exim -p wa -k exim_log_monitor