CVE DatabaseCVE-2023-2868

Updated 2026-06-17한국어 권고문 →

CVE-2023-28689.8/CRITICALCISA KEVCWE-20CWE-77

Barracuda Email Security Gateway (ESG) Remote Command Injection Vulnerability (CVE-2023-2868) Security Advisory

⚡ Jump to Patch

Affected Vendors

barracuda

Affected Components

email security gateway

Published Date

2023-05-24

CVSS v3.1

9.8

CRITICAL

EPSS (30d)

86.8%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Barracuda Email Security Gateway (appliance form factor only) versions 5.1.3.001 through 9.2.0.006

Impact

A remote attacker can execute arbitrary system commands with the privileges of the ESG product by sending a specially crafted .tar archive, leading to complete system compromise

Mitigation

Verify the automatic application of patch BNSF-36456, perform a thorough compromise assessment (IoC search), and immediately replace compromised appliances

Affected Products & Version Scope

Barracuda Email Security Gateway (appliance form factor only) versions 5.1.3.001 through 9.2.0.006

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Barracuda has automatically applied the security patch BNSF-36456 to all active customer appliances. Administrators should verify that the appliance is online and has successfully received the update. Use the following CLI commands to check the patch status:

bash

# Access the Barracuda ESG CLI and list applied patches
show patches

# Verify the current system firmware version and patch application
show version

2. Temporary Workaround & Hardening Configuration

If you need to restrict access to the appliance during investigation, ensure that the management interface is not exposed to the public internet. Implement strict firewall rules to allow only trusted administrative IPs:

bash

# Example iptables rules to restrict access to the ESG management port (e.g., 443)
# Allow trusted administrator IP
iptables -A INPUT -p tcp -s 192.168.10.100 --dport 443 -j ACCEPT

# Drop all other external traffic to the management port
iptables -A INPUT -p tcp --dport 443 -j DROP

3. Log Audit & IoC Verification Commands

Because this vulnerability has been actively exploited in the wild, patching alone may not remediate an already compromised appliance. Run the following commands to inspect the system for suspicious processes and network connections:

bash

# Check for suspicious Perl processes executing shell commands
ps aux | grep -i 'perl' | grep -E 'qx|sh|bash'

# Audit active outbound network connections to unrecognized external IPs
netstat -antp | grep -E 'ESTABLISHED' | grep -v '192.168.'

# Scan mail logs for suspicious tar file processing containing shell metacharacters
grep -i '\.tar' /var/log/maillog | grep -E '[`;|&]'

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

NordLayer / Zero-Trust Network Access

Since patched appliances may still host active backdoors if compromised prior to patching, conduct an immediate IoC audit and replace any compromised physical or virtual appliances.

Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access

Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.

90% Attack Surface Reduction · Hardware-Free

Explore Zero-Trust Network Access Plans

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

A critical remote command injection vulnerability (CVE-2023-2868) exists in the Barracuda Email Security Gateway (ESG) appliance. The root cause of this vulnerability lies in the incomplete input validation and failure to sanitize user-supplied .tar (tape archive) files. Specifically, when parsing the names of the files contained within the archive, the system fails to sanitize shell metacharacters before passing them to Perl's qx operator, leading to command injection (CWE-77, CWE-20).

2. Exploitation Mechanics & Attack Scenario

An attacker exploits this vulnerability by sending an email containing a specially formatted .tar file as an attachment. The file names inside this archive are crafted to contain shell metacharacters (such as backticks '', ;, or |) along with malicious payloads. When the ESG appliance automatically processes and unpacks the attachment for scanning, the internal Perl script extracts the file names and executes them via the qx` operator. This triggers the execution of the embedded shell commands with the high privileges of the ESG product, allowing the attacker to establish reverse shells or download secondary payloads.

3. Infrastructure & Business Impact

With a CVSS score of 9.8 and its inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog, this vulnerability represents an extreme risk. Successful exploitation allows threat actors to gain persistent access to the email gateway, intercept or alter sensitive email communications, and pivot deeper into the internal corporate network, potentially leading to ransomware deployment or massive data exfiltration.

Official Vendor Advisories & References

NVD Original English Description

A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar file (tape archives). The vulnerability stems from incomplete input validation of a user-supplied .tar file as it pertains to the names of the files contained within the archive. As a consequence, a remote attacker can specifically format these file names in a particular manner that will result in remotely executing a system command through Perl's qx operator with the privileges of the Email Security Gateway product. This issue was fixed as part of BNSF-36456 patch. This patch was automatically applied to all customer appliances.

https://status.barracuda.com/incidents/34kx82j5n4q9

Source: cve-coordination@google.com · Vendor Advisory

https://www.barracuda.com/company/legal/esg-vulnerability

Source: cve-coordination@google.com · Mitigation, Vendor Advisory

https://status.barracuda.com/incidents/34kx82j5n4q9

Source: af854a3a-2127-422b-91ae-364da2661108 · Vendor Advisory

https://www.barracuda.com/company/legal/esg-vulnerability

Source: af854a3a-2127-422b-91ae-364da2661108 · Mitigation, Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-2868

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

Frequently Asked SecOps Questions (CVE-2023-2868)

FAQ

Q1. How critical is CVE-2023-2868 and is it actively exploited in the wild?

CVE-2023-2868 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 86.8%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2023-2868?

Primary impacted vendors include barracuda across email security gateway. Scope summary: Barracuda Email Security Gateway (appliance form factor only) versions 5.1.3.001 through 9.2.0.006

Q3. What temporary mitigations or workarounds exist for CVE-2023-2868 before patching?

[Mitigation] Verify the automatic application of patch BNSF-36456, perform a thorough compromise assessment (IoC search), and immediately replace compromised appliances Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION