CVE-2024-50624

What it actually does

The flaw permits man-in-the-middle interception by retrieving mail account configuration over cleartext HTTP URLs such as http://autoconfig.example.com or http://example.com/.well-known/autoconfig, allowing an attacker to supply a malicious mail server address.

Why it matters to the business

Organizations risk exposure of email account credentials and message content when users set up accounts on shared or untrusted networks; low EPSS and absence from KEV indicate limited active exploitation but the cryptographic weakness still warrants prompt patching of affected tripleo-heat-templates packages.

How an attack unfolds

An attacker on the local network or controlling a network path observes the client issuing an HTTP request for autoconfiguration data, responds with a crafted XML payload that specifies an attacker-controlled mail server, and the client then connects to that server, enabling subsequent credential or message interception.

How to fix it

Upgrade tripleo-heat-templates on Ubuntu 18.04 LTS to version 5.2.0-1 or later; additionally ensure any Kmail deployment is at least version 6.2.0 and enforce HTTPS-only autoconfiguration retrieval where possible.

How to confirm the fix worked

Verify the installed package version matches or exceeds the fixed release, inspect source or configuration for absence of hardcoded http:// autoconfig endpoints, and test account setup on a controlled network segment to confirm only HTTPS URLs are used.

Typical attack path

1. Gain network position allowing observation or redirection of HTTP traffic
2. Wait for or trigger an autoconfiguration lookup using a cleartext URL
3. Return attacker-controlled autoconfig data pointing to a malicious mail server
4. Receive the victim's connection to the attacker mail server and capture credentials or mail

How to detect it

Search mail-client and system logs for HTTP requests to autoconfig or .well-known/autoconfig endpoints, unexpected mail-server hostnames in configuration files, and outbound connections established immediately after account-wizard activity.

What your security team should do

• Apply the listed fixed package version immediately on all Ubuntu 18.04 LTS systems running the affected component
• Audit mail-client configuration flows to confirm HTTPS is enforced for autoconfiguration
• Add network monitoring for unexpected outbound connections to non-standard mail ports during account setup
• Review EPSS trend remains low and re-evaluate if new exploit code appears