Manipulation of Internal Dovecot Variables in mailcow via crafted Passwords

CVE-2023-34108

What is CVE-2023-34108?

A vulnerability in the Mailcow Mail Server Suite enables attackers to manipulate internal Dovecot variables by exploiting the passwd-verify.lua script during the password authentication process. By crafting passwords with appended key-value pairs, an authenticated attacker can alter the response generated by the script, influencing Dovecot's internal behavior. This manipulation may lead to unauthorized access, bypassing security controls, or other malicious activities. To mitigate risks, users should upgrade to version 2023-05a as there are no workarounds available.

References