CVE-2024-39929: Exim Auth Bypass Vulnerability

CVE-2024-39929 Overview

CVE-2024-39929 is an input validation vulnerability in Exim mail transfer agent through version 4.97.1 that allows remote attackers to bypass filename extension-blocking protection mechanisms. The vulnerability stems from improper parsing of multiline RFC 2231 header filenames, enabling attackers to potentially deliver executable attachments to end users' mailboxes despite configured security policies.

Critical Impact

Attackers can bypass the $mime_filename extension-blocking protection mechanism in Exim, potentially delivering malicious executable attachments to end users even when administrators have configured policies to block dangerous file types.

Affected Products

• Exim versions through 4.97.1
• All Exim installations using $mime_filename extension-blocking protection
• Mail servers relying on Exim's MIME filename filtering for attachment security

Discovery Timeline

• 2024-07-04 - CVE CVE-2024-39929 published to NVD
• 2025-07-10 - Last updated in NVD database

Technical Details for CVE-2024-39929

Vulnerability Analysis

This vulnerability affects Exim's MIME header parsing functionality, specifically how it handles RFC 2231 encoded filenames that span multiple lines. RFC 2231 defines a mechanism for parameter value character set and language information, as well as parameter value continuations for long values. Exim's implementation fails to properly reassemble these multiline filenames before applying security checks, creating a security bypass condition.

The $mime_filename variable in Exim is commonly used by administrators to implement attachment filtering rules that block potentially dangerous file extensions such as .exe, .bat, .cmd, and other executable formats. When an attacker crafts a malicious email with a filename split across multiple RFC 2231 continuation lines, Exim incorrectly parses the filename, allowing attachments with blocked extensions to slip through the filter.

Root Cause

The root cause is classified as CWE-116 (Improper Encoding or Escaping of Output). Exim's MIME parsing code does not correctly handle the reassembly of multiline RFC 2231 header filenames before evaluating them against the $mime_filename extension-blocking rules. This creates a disconnect between what the mail server sees during filtering and what the end user's mail client interprets as the actual filename.

Attack Vector

The attack is network-based and requires user interaction. An attacker sends a specially crafted email with a malicious attachment where the filename is encoded using RFC 2231 multiline continuation syntax. The Exim server's extension-blocking filter fails to recognize the blocked extension due to the misparsing, and the email is delivered to the recipient's mailbox. When the recipient opens the email, their mail client correctly reassembles the filename, presenting them with an attachment that appears to have a dangerous extension.

The attack flow involves:

1. Attacker crafts an email with a MIME attachment using RFC 2231 multiline filename encoding
2. The filename is split across continuation lines to evade Exim's parsing
3. Exim's $mime_filename check does not correctly identify the blocked extension
4. The malicious attachment is delivered to the end user's mailbox
5. The recipient's mail client properly decodes the filename, exposing the executable attachment

For technical implementation details, see the Exim Bug Report #3099 and the RFC 2231 Specification.

Detection Methods for CVE-2024-39929

Indicators of Compromise

• MIME headers containing RFC 2231 continuation parameters with suspicious filename patterns
• Email attachments with multiline Content-Disposition headers using parameter continuation syntax (e.g., filename*0=, filename*1=)
• Executable files delivered to mailboxes despite configured extension-blocking rules
• Anomalous MIME parsing behavior in Exim logs

Detection Strategies

• Monitor Exim mail logs for unusual RFC 2231 encoded attachment filenames
• Implement additional email gateway scanning that reassembles RFC 2231 filenames before inspection
• Deploy endpoint detection to identify executable attachments that bypassed server-side filtering
• Create SIEM alerts for emails with multiple filename* continuation parameters in MIME headers

Monitoring Recommendations

• Review Exim server version and compare against patched releases (4.98-RC3 and later)
• Audit current $mime_filename filtering rules and their effectiveness
• Monitor for sudden increases in executable attachment delivery to end users
• Implement secondary attachment scanning at the endpoint or mail client level

How to Mitigate CVE-2024-39929

Immediate Actions Required

• Upgrade Exim to version 4.98-RC3 or later which includes the security fix
• Review and audit all mail servers running Exim for affected versions
• Implement additional attachment scanning layers that are not dependent on Exim's MIME parsing
• Consider temporarily blocking all RFC 2231 encoded attachments until patching is complete

Patch Information

The Exim development team has released security patches to address this vulnerability. The fixes are available in commits 1b3209b0 and 6ce5c70c. Administrators should upgrade to Exim 4.98-RC3 or later. The version comparison showing the security changes can be reviewed at the Exim Version Comparison page.

Workarounds

• Deploy a secondary email security gateway with independent MIME parsing capabilities
• Implement endpoint protection that scans attachments upon download or execution
• Use content inspection tools that correctly handle RFC 2231 multiline filenames
• Consider adding explicit checks in ACL rules for RFC 2231 continuation syntax in attachment headers

# Example Exim version check
exim -bV | grep version

# Verify current Exim configuration for mime_filename usage
grep -r "mime_filename" /etc/exim4/