CVE-2024-28054: Amavis MIME Boundary Information Disclosure

CVE-2024-28054 Overview

CVE-2024-28054 is a MIME parsing flaw in Amavis, an open-source content filter used in mail gateways to scan messages for malware, spam, and banned files. Versions before 2.12.3 and 2.13.x before 2.13.1 mishandle email messages that contain multiple boundary parameters in a MIME header. The root cause lies in part within the MIME-tools Perl library that Amavis relies on for parsing. Because Amavis and downstream mail user agents interpret the conflicting boundaries differently, attackers can craft messages whose visible content differs from what Amavis scans. This is classified as an Interpretation Conflict weakness [CWE-436].

Critical Impact
A remote attacker can bypass malware and banned-file checks by abusing MIME boundary ambiguity, delivering malicious attachments to recipients while Amavis scans benign content.

Affected Products

Amavis versions prior to 2.12.3
Amavis 2.13.x versions prior to 2.13.1
Mail systems using MIME-tools Perl library through Amavis (including Fedora package distributions)

Discovery Timeline

2024-03-18 - CVE-2024-28054 published to the National Vulnerability Database
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-28054

Vulnerability Analysis

MIME (Multipurpose Internet Mail Extensions) uses a boundary parameter in the Content-Type: multipart/* header to separate message parts. RFC 2046 specifies that a single boundary parameter must be present per multipart header. The Amavis parser, leveraging MIME-tools, selects one boundary when multiple are supplied. Many mail user agents (MUAs) select a different boundary, producing divergent parse trees for the same byte stream.

Attackers exploit this divergence to smuggle attachments. Amavis sees one structure and approves the message, while the recipient's MUA renders an alternative structure exposing a malicious payload. The flaw defeats the core security function of the gateway: virus scanning and banned-file enforcement.

Root Cause

The defect is an Interpretation Conflict [CWE-436] between two parsers operating on the same input. MIME-tools does not reject or normalize duplicate boundary parameters, and Amavis does not detect the ambiguity prior to delivery. No memory corruption is involved; the vulnerability is purely a logic and specification-handling issue.

Attack Vector

Exploitation requires only the ability to send a crafted email to a recipient protected by a vulnerable Amavis instance. The attacker constructs a multipart/mixed message with two boundary values in the Content-Type header. One boundary frames a benign part for Amavis; the other frames a malicious attachment that the recipient MUA renders. Refer to the GitLab CVE-2024-28054 README for the vendor's technical writeup and proof-of-concept structure.

Detection Methods for CVE-2024-28054

Indicators of Compromise

Inbound multipart/* messages containing more than one boundary parameter within a single Content-Type header
Mail logs showing Amavis verdicts of Clean for messages that recipients later report as malicious
Discrepancies between Amavis-extracted attachment lists and attachments rendered by downstream MUAs

Detection Strategies

Parse Content-Type headers at the MTA edge and flag any message declaring duplicate boundary parameters
Compare attachment hashes extracted by Amavis against those extracted by a secondary parser (for example, ClamAV directly) and alert on mismatches
Hunt mail archives retroactively for messages with multiple boundary parameters delivered before patching

Monitoring Recommendations

Forward Amavis and MTA logs to a centralized analytics platform and build queries for malformed MIME structures
Track Amavis version inventory across mail gateways and alert when hosts run versions below 2.12.3 or 2.13.1
Correlate user-reported phishing with mail-flow events to surface bypassed scans early

How to Mitigate CVE-2024-28054

Immediate Actions Required

Upgrade Amavis to version 2.12.3 or 2.13.1 or later on every mail gateway
Update the MIME-tools Perl module to a version that handles duplicate boundary parameters safely
Apply the Fedora package updates referenced in the Fedora Package Announcement for affected distributions
Audit recent mail traffic for the indicators listed above and quarantine suspect messages

Patch Information

The Amavis project released fixed versions 2.12.3 and 2.13.1, which reject or normalize messages with multiple boundary parameters before scanning. Details and downloads are available in the Amavis Release Notes and the upstream GitLab Issue #112.

Workarounds

Configure the upstream MTA (Postfix, Sendmail, Exim) to reject messages whose Content-Type header contains more than one boundary parameter
Add a header_checks or milter rule that drops or quarantines multipart/* messages with malformed MIME structures
Enforce strict MIME validation at the perimeter using a secondary content filter until Amavis can be upgraded

bash

# Postfix header_checks rule to reject duplicate boundary parameters
# /etc/postfix/header_checks
/^Content-Type:.*boundary=.*boundary=/  REJECT Malformed MIME: duplicate boundary parameter

# Activate in /etc/postfix/main.cf
# header_checks = regexp:/etc/postfix/header_checks
# Then reload: postfix reload