CVE-2023-2868: Barracuda Email Security Gateway RCE Flaw

CVE-2023-2868 Overview

A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product affecting versions 5.1.3.001-9.2.0.006. This vulnerability has been actively exploited in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog, making it a significant threat requiring immediate attention.

The vulnerability arises from a failure to comprehensively sanitize the processing of .tar file (tape archives). Specifically, it stems from incomplete input validation of user-supplied .tar files as it pertains to the names of the files contained within the archive. A remote attacker can specifically format these file names in a particular manner that will result in remotely executing system commands through Perl's qx operator with the privileges of the Email Security Gateway product.

Critical Impact

Remote unauthenticated attackers can execute arbitrary system commands with Email Security Gateway privileges by sending specially crafted .tar file attachments through email, potentially leading to complete system compromise.

Affected Products

• Barracuda Email Security Gateway 300 (firmware versions 5.1.3.001-9.2.0.006)
• Barracuda Email Security Gateway 400 (firmware versions 5.1.3.001-9.2.0.006)
• Barracuda Email Security Gateway 600 (firmware versions 5.1.3.001-9.2.0.006)
• Barracuda Email Security Gateway 800 (firmware versions 5.1.3.001-9.2.0.006)
• Barracuda Email Security Gateway 900 (firmware versions 5.1.3.001-9.2.0.006)

Discovery Timeline

• 2023-05-24 - CVE-2023-2868 published to NVD
• 2025-10-24 - Last updated in NVD database

Technical Details for CVE-2023-2868

Vulnerability Analysis

This command injection vulnerability (CWE-77) combined with improper input validation (CWE-20) affects the Barracuda Email Security Gateway's tar file processing functionality. The vulnerability exists in the appliance form factor only, where the email gateway processes incoming attachments for security scanning.

When the Email Security Gateway processes email attachments containing .tar archives, it extracts and examines the contents. The file names within the tar archive are passed to Perl code that uses the qx operator (backtick operator) for command execution. Due to insufficient sanitization of these file names, an attacker can craft malicious file names containing shell metacharacters or command sequences that will be executed by the underlying system.

The exploitation requires no authentication and can be performed remotely over the network, making this vulnerability particularly dangerous for internet-facing email security appliances.

Root Cause

The root cause is incomplete input validation of user-supplied file names within .tar archives. The Email Security Gateway fails to properly sanitize file name strings before passing them to Perl's qx operator, which executes the provided string as a shell command. This allows specially crafted file names containing command injection payloads to be executed with the privileges of the Email Security Gateway process.

Attack Vector

The attack vector is network-based and requires no user interaction or authentication. An attacker can exploit this vulnerability by:

1. Crafting a malicious .tar archive with specially formatted file names containing command injection payloads
2. Sending an email with the malicious .tar file as an attachment to any recipient protected by the vulnerable Barracuda Email Security Gateway
3. When the gateway processes the email attachment for scanning, it extracts and processes the tar file contents
4. The malicious file names are passed unsanitized to Perl's qx operator, executing the attacker's commands with gateway privileges

The attack does not require the email to be delivered to the recipient—simply processing the email through the vulnerable gateway is sufficient for exploitation.

Detection Methods for CVE-2023-2868

Indicators of Compromise

• Unexpected child processes spawned by the Email Security Gateway services, particularly shell interpreters or command-line utilities
• Unusual outbound network connections from the ESG appliance to unknown external IP addresses
• Presence of unfamiliar .tar files in mail processing directories or temporary storage
• Anomalous Perl process activity with unexpected command arguments
• Web shells or backdoor files appearing on the appliance file system

Detection Strategies

• Monitor system logs for Perl processes executing unexpected shell commands via the qx operator
• Implement network detection rules to identify suspicious outbound traffic from ESG appliances
• Review email logs for messages containing .tar attachments with unusual or malformed file names
• Deploy endpoint detection on systems communicating with the ESG appliance to identify lateral movement attempts
• Conduct regular file integrity monitoring on ESG appliances to detect unauthorized modifications

Monitoring Recommendations

• Enable verbose logging on Barracuda ESG appliances and forward logs to a SIEM for correlation
• Implement network segmentation to limit the blast radius if an ESG appliance is compromised
• Monitor for command and control traffic patterns from email gateway infrastructure
• Set up alerts for any process execution anomalies on the ESG appliance platform

How to Mitigate CVE-2023-2868

Immediate Actions Required

• Verify that patch BNSF-36456 has been applied to all Barracuda ESG appliances—this patch was automatically deployed to customer appliances
• Check the appliance firmware version to ensure it is above 9.2.0.006
• Review Barracuda's incident report and vulnerability disclosure for additional guidance
• Conduct a forensic analysis of potentially compromised appliances for signs of exploitation
• Consider replacing affected appliances if evidence of compromise is found, as recommended by Barracuda

Patch Information

Barracuda has addressed this vulnerability as part of patch BNSF-36456. According to the vendor, this patch was automatically applied to all customer appliances. Organizations should verify the patch has been successfully applied by checking the appliance management interface for the current firmware version.

For detailed patch information, refer to:

• Barracuda Incident Report
• Barracuda ESG Vulnerability Disclosure

This vulnerability is also tracked in the CISA Known Exploited Vulnerabilities Catalog.

Workarounds

• Implement email filtering upstream to block or quarantine emails containing .tar attachments until patching is confirmed
• Place the ESG appliance behind additional network security controls to limit exposure
• Consider temporarily routing email through alternative security solutions if the appliance cannot be immediately verified as patched
• Enable additional logging and monitoring on network segments containing ESG appliances to detect exploitation attempts