Majordomo2 - SMTP/HTTP Directory Traversal

By Anandhu Krishnan Anandhu Krishnan
Published on 01 Oct 2021
Vulnerability

The _list file get function in lib/Majordomo.pm in Majordomo 2 before 20110131 has a directory traversal vulnerability that allows remote attackers to read arbitrary files using dot dot(..) sequences in the help command, as shown by a forged email and cgi-bin/mj wwwusr in the web interface.

Mitigation / Precaution

We recommend you update to snapshot 20110204 or later.

Anandhu Krishnan
Written by
Anandhu Krishnan
Lead Engineer

Anandhu is an accomplished Senior Lead Engineer with a strong focus on back-end development. His expertise lies in architecting and optimizing the core of software applications to ensure they run smoothly and efficiently. With a meticulous attention to detail and a deep understanding of data management and server-side operations, Anandhu has been a driving force behind the success of various back-end projects.

Experience the Beagle Security platform
Unlock one full penetration test and all Advanced plan features free for 14 days
4.8 on G2 • ISO 27001 certified
See How Beagle Security Works
No credit card • No setup required
Launch interactive demo