CVE-2023-2868

What it actually does

CVE-2023-2868 is an unauthenticated remote command injection flaw in Barracuda Email Security Gateway physical appliances running affected firmware versions 5.1.3.001 through 9.2.0.006. The vulnerable code processes user-supplied .tar archives and fails to safely validate file names inside the archive before passing them into Perl execution logic using the qx operator. A specially crafted archive can therefore cause the appliance to execute attacker-controlled operating system commands with the privileges of the ESG product. Successful exploitation can provide remote code execution, enable malware installation, credential or mail data theft, configuration tampering, persistence, and full appliance compromise.

Why it matters to the business

This vulnerability affects internet-facing email security appliances, which are high-value choke points for inbound and outbound mail. A compromise can expose sensitive email content, authentication material, mail-routing configuration, and security-filtering logic, while also allowing attackers to maintain a foothold inside the network perimeter. The issue is listed in CISA KEV, has a very high EPSS score, and has been actively exploited in the wild for an extended period; the CISA remediation due date of 2023-06-16 has long passed. Because this vulnerability was used in targeted appliance compromises, organizations should treat exposed or historically vulnerable Barracuda ESG physical appliances as high priority even if an automatic patch was applied.

How an attack unfolds

An attacker sends or otherwise submits an email containing a malicious .tar archive to an affected Barracuda Email Security Gateway appliance. During archive inspection, the ESG extracts or parses file names from the .tar contents. Because the appliance does not comprehensively sanitize those file names, attacker-controlled strings can reach Perl qx command execution. The injected command then runs on the appliance without authentication or user interaction. In observed real-world campaigns, attackers used this access to execute shell commands, deploy backdoors and persistence mechanisms, collect system and email-related data, and maintain stealthy access to compromised appliances. Public reporting associated exploitation with Barracuda ESG appliance compromises, including malware families such as SALTWATER, SEASIDE, SEASPY, SUBMARINE, and DEPTHCHARGE, and activity tracked by Mandiant as UNC4841.

How to fix it

Apply Barracuda guidance immediately. Barracuda automatically deployed patch BNSF-36456 to customer appliances, but organizations should not rely on patch status alone for appliances that were exposed during the exploitation window. Confirm the appliance is no longer running affected firmware versions 5.1.3.001 through 9.2.0.006 and verify that all vendor security updates and definitions are current. For any appliance with indicators of compromise or uncertain historical exposure, follow Barracuda’s incident guidance, which has included isolating and replacing compromised physical ESG appliances rather than only reimaging or patching them. Rotate credentials, API keys, LDAP/service-account passwords, mail relay secrets, TLS/private keys, and administrative credentials that were present on or accessible from the appliance. Review mail-routing rules, allow/block lists, administrator accounts, SSH keys, scheduled tasks, and system binaries for unauthorized changes. If the appliance is no longer required, remove it from internet exposure and decommission it securely.

How to confirm the fix worked

Confirm the appliance model and firmware version, and verify that BNSF-36456 or later vendor security content has been applied. Check vendor security advisories and support tooling for appliance-specific compromise indicators. Validate that no vulnerable physical ESG appliances remain internet-accessible. Review system integrity against known-good firmware images or vendor-provided checks where available. Confirm that unexpected processes, startup entries, modified binaries, suspicious files in temporary or product directories, and unauthorized administrative accounts are absent. Send a benign test .tar archive through mail inspection to confirm normal processing continues after remediation, but do not attempt exploit reproduction on production appliances. Validate that credential rotation has completed for all secrets that may have been present on the appliance, and confirm mail flow, filtering, logging, and administrative access operate normally after remediation or replacement.

Typical attack path

1. Identify an internet-facing Barracuda Email Security Gateway physical appliance running an affected firmware branch.
2. Deliver a crafted email or payload containing a malicious .tar archive to the appliance for inspection.
3. Abuse insufficient validation of .tar member file names to inject commands into Perl qx execution logic.
4. Execute operating system commands with ESG product privileges.
5. Download or stage additional scripts, web shells, backdoors, or modified binaries on the appliance.
6. Collect mail, configuration, credentials, logs, or appliance metadata.
7. Establish persistence or covert command-and-control using appliance-resident malware.
8. Use the compromised email gateway as a foothold for espionage, data theft, mail manipulation, or further network access.

How to detect it

Investigate both attempted exploitation and post-exploitation activity. Review Barracuda ESG mail-processing logs, attachment-scanning logs, system logs, shell history where available, web/admin logs, network flow records, DNS logs, EDR/NDR telemetry, and firewall/proxy logs covering the period before and after May 2023. Look for inbound messages with .tar attachments, especially archives whose internal file names contain shell metacharacters such as backticks, semicolons, pipes, dollar-parentheses command substitution, redirection operators, or newline characters. Search for commands spawned by mail-scanning, archive-processing, Perl, or Barracuda product processes, particularly curl, wget, nc, bash, sh, chmod, chown, perl, python, openssl, or commands writing to /tmp, /var/tmp, /dev/shm, or Barracuda product directories. Hunt for modified ESG binaries, unexpected startup scripts, unknown listening services, suspicious outbound connections from the appliance, unusual DNS lookups, and evidence of known Barracuda ESG malware families reported in active exploitation, including SALTWATER, SEASIDE, SEASPY, SUBMARINE, and DEPTHCHARGE. Examine configuration changes, administrator account creation, SSH key additions, mail forwarding or relay changes, and abnormal access to message queues or stored mail. If compromise is suspected, preserve the appliance state and logs before replacement or remediation actions.

• .tar
• qx(
• `
• ;$(
• $(
• |/bin/sh
• |/bin/bash
• ;curl
• ;wget
• /tmp/
• /var/tmp/
• /dev/shm/
• /bin/sh -c
• /bin/bash -c
• perl -e
• python -c
• chmod +x
• wget http
• curl http
• nc -e
• /home/product/
• bsmtpd
• SALTWATER
• SEASIDE
• SEASPY
• SUBMARINE
• DEPTHCHARGE
• UNC4841

What your security team should do

• Treat this as an incident-response priority for any Barracuda ESG physical appliance that was internet-facing while running affected versions, because the vulnerability is KEV-listed and actively exploited.
• Inventory all Barracuda Email Security Gateway physical appliances, firmware versions, exposure points, and replacement status.
• Confirm Barracuda patch BNSF-36456 or later mitigation is present, but perform compromise assessment even on patched appliances that were exposed before remediation.
• Isolate any appliance showing compromise indicators and engage Barracuda support; replace compromised ESG appliances in line with vendor guidance.
• Collect and preserve appliance logs, mail-processing logs, system artifacts, and network telemetry before rebuilding, replacing, or decommissioning hardware.
• Hunt for known Barracuda ESG malware families and related artifacts, including SALTWATER, SEASIDE, SEASPY, SUBMARINE, and DEPTHCHARGE indicators.
• Rotate all credentials and cryptographic material that may have been stored on or traversed the appliance.
• Review historical email gateway logs for suspicious .tar attachments, unusual archive member names, outbound connections, unexpected downloads, and anomalous administrative actions.
• Add detections for archive file names containing shell metacharacters and for suspicious process execution from mail-scanning or Barracuda product processes.
• Limit administrative access to ESG management interfaces, restrict outbound connectivity from appliances, and forward appliance logs to centralized monitoring.