Exim before 4

CVE-2023-51766 is an SMTP smuggling flaw in Exim affecting all versions up to 4.97 inclusive and fixed in 4.97.1. Under a specific set of conditions—most importantly when the inbound Exim server advertises both PIPELINING and CHUNKING, the sender uses DATA rather than BDAT, and the upstream relay preserves a malformed line-ending sequence—an attacker can smuggle a second mail transaction inside the body of the first. The result is spoofed e-mail acceptance with SPF bypass characteristics, not host compromise.

The vendor's MEDIUM 5.3 is a bit generous in practice. CVSS sees 'unauthenticated network' and stops there; reality adds multiple compounding friction points: the target must be an exposed Exim MTA, the config must advertise both required SMTP extensions, the attacker needs a compatible upstream relay path, and the payoff is limited to message integrity/phishing amplification rather than code execution, privilege gain, or mailbox/database takeover.

Why this verdict

• Downgraded for compound prerequisites: this is not 'send one packet, own the box.' The attacker needs an exposed Exim listener, both required SMTP extensions enabled, a DATA-based path, and an upstream relay that preserves the malformed delimiter.
• Impact is bounded: successful exploitation yields spoofing / SPF-bypass style integrity impact, not RCE, credential theft from the host, mailbox dump, or privilege escalation on the MTA.
• Detection and surrounding controls help: DMARC enforcement, secure mail gateways, anti-phish filtering, and protocol normalization frequently break or blunt the attack before it becomes a successful delivered phish.

Why not higher?

If this were a straight unauthenticated RCE on a public mail server, the exposure pattern alone would justify HIGH or CRITICAL. It is not. The protocol mismatch requirement means a large share of nominally affected hosts will never see a working exploit chain in real deployments.

Why not lower?

This is still an internet-reachable mail trust bug on a high-value control point, and a successful exploit can materially improve phishing success by landing spoofed messages that appear more trustworthy. If you run exposed Exim MX infrastructure, this is worth fixing; it just does not deserve emergency-server-compromise treatment.

1. Disable CHUNKING or PIPELINING on inbound Exim — This is the upstream-documented workaround and directly breaks the published smuggling chain. For a LOW verdict there is no mitigation SLA (treat as backlog hygiene), so do this in the next normal mail change window if you cannot patch promptly.
2. Enforce DMARC reject/quarantine where business-ready — This does not fix Exim, but it reduces the delivered value of spoofed messages by making downstream acceptance less dependent on SPF alone. For a LOW verdict there is no mitigation SLA (treat as backlog hygiene); schedule it as part of normal mail-auth hardening.
3. Test exposed MX hosts with protocol-aware validation — Run an EHLO capability check and a safe SMTP smuggling test against public-facing mail servers so you can separate noisy version findings from actually reachable exposure. For a LOW verdict there is no mitigation SLA (treat as backlog hygiene); complete this during the next exposure review cycle.
4. Prefer front-end normalization at the mail edge — If you run gateways or relays in front of Exim, make sure they normalize or reject malformed SMTP line endings before traffic reaches the backend MTA. For a LOW verdict there is no mitigation SLA (treat as backlog hygiene); handle in normal gateway policy maintenance.

Run this on the target Exim host or from an auditor workstation that can reach the server's SMTP port. Invoke it as bash verify-cve-2023-51766.sh 127.0.0.1 25 or bash verify-cve-2023-51766.sh mail.example.com 25; no root is required, but local package checks work best on the target host.

#!/usr/bin/env bash
# verify-cve-2023-51766.sh
# Check likely exposure to CVE-2023-51766 (Exim SMTP smuggling)
# Exit codes: 0 PATCHED, 1 VULNERABLE, 2 UNKNOWN

set -u
HOST="${1:-127.0.0.1}"
PORT="${2:-25}"

say() { printf '%s\n' "$*"; }
ver_ge() { [ "$(printf '%s\n%s\n' "$2" "$1" | sort -V | head -n1)" = "$2" ]; }

get_exim_version() {
  if command -v exim >/dev/null 2>&1; then
    exim -bV 2>/dev/null | awk '/^Exim version/ {print $3; exit}'
    return 0
  fi
  return 1
}

check_local_backport() {
  # Debian/Ubuntu package-based backport checks.
  if command -v dpkg-query >/dev/null 2>&1; then
    pkgver=$(dpkg-query -W -f='${Version}' exim4-base 2>/dev/null || true)
    if [ -n "$pkgver" ]; then
      case "$pkgver" in
        4.92-8+deb10u9*|4.92-8+deb10u1[0-9]*|4.92-8+deb10u[9-9]*) return 10 ;;
        4.94.2-7+deb11u[2-9]*|4.94.2-7+deb11u1[0-9]*) return 10 ;;
        4.96-15+deb12u[4-9]*|4.96-15+deb12u1[0-9]*) return 10 ;;
        4.95-4ubuntu2.5*|4.95-4ubuntu2.[6-9]*|4.95-4ubuntu2.1[0-9]*) return 10 ;;
        4.93-13ubuntu1.10*|4.93-13ubuntu1.1[1-9]*|4.93-13ubuntu1.[2-9][0-9]*) return 10 ;;
        4.90.1-1ubuntu1.10+esm3*|4.90.1-1ubuntu1.10+esm[4-9]*|4.90.1-1ubuntu1.1[1-9]*|4.90.1-1ubuntu1.[2-9][0-9]*) return 10 ;;
        4.86.2-2ubuntu2.6+esm6*|4.86.2-2ubuntu2.6+esm[7-9]*|4.86.2-2ubuntu2.[7-9]*|4.86.2-2ubuntu2.1[0-9]*) return 10 ;;
      esac
    fi
  fi
  return 11
}

smtp_ehlo_caps() {
  local host="$1" port="$2"
  if command -v nc >/dev/null 2>&1; then
    {
      printf 'EHLO verifier.example\r\nQUIT\r\n'
      sleep 1
    } | nc -w 5 "$host" "$port" 2>/dev/null
    return $?
  elif command -v timeout >/dev/null 2>&1; then
    timeout 5 bash -c "exec 3<>/dev/tcp/$host/$port; printf 'EHLO verifier.example\r\nQUIT\r\n' >&3; cat <&3" 2>/dev/null
    return $?
  fi
  return 99
}

LOCAL_EXIM_VER=""
if LOCAL_EXIM_VER=$(get_exim_version); then
  :
fi

if check_local_backport; rc=$?; [ "$rc" -eq 10 ]; then
  say "PATCHED: local package version is a known distro-fixed/backported Exim build"
  exit 0
fi

EHLO_OUT=$(smtp_ehlo_caps "$HOST" "$PORT" || true)
if [ -z "$EHLO_OUT" ]; then
  if [ -n "$LOCAL_EXIM_VER" ] && ver_ge "$LOCAL_EXIM_VER" "4.97.1"; then
    say "PATCHED: local Exim version $LOCAL_EXIM_VER is >= 4.97.1"
    exit 0
  fi
  say "UNKNOWN: could not retrieve SMTP capabilities from $HOST:$PORT"
  exit 2
fi

HAS_PIPELINING=0
HAS_CHUNKING=0
printf '%s\n' "$EHLO_OUT" | grep -qi 'PIPELINING' && HAS_PIPELINING=1
printf '%s\n' "$EHLO_OUT" | grep -qi 'CHUNKING' && HAS_CHUNKING=1

if [ -n "$LOCAL_EXIM_VER" ] && ver_ge "$LOCAL_EXIM_VER" "4.97.1"; then
  say "PATCHED: local Exim version $LOCAL_EXIM_VER is >= 4.97.1"
  exit 0
fi

if [ -n "$LOCAL_EXIM_VER" ]; then
  if [ "$HAS_PIPELINING" -eq 1 ] && [ "$HAS_CHUNKING" -eq 1 ]; then
    say "VULNERABLE: Exim version $LOCAL_EXIM_VER appears < 4.97.1 and SMTP advertises both PIPELINING and CHUNKING"
    exit 1
  else
    say "UNKNOWN: Exim version $LOCAL_EXIM_VER appears < 4.97.1, but SMTP does not advertise both PIPELINING and CHUNKING; config may already mitigate this CVE"
    exit 2
  fi
fi

# No local version available; rely on capabilities only.
if [ "$HAS_PIPELINING" -eq 1 ] && [ "$HAS_CHUNKING" -eq 1 ]; then
  say "UNKNOWN: target advertises both PIPELINING and CHUNKING, but local Exim version/package data is unavailable"
  exit 2
fi

say "UNKNOWN: insufficient evidence to determine exposure conclusively"
exit 2

Sources

1. NVD CVE-2023-51766
2. Exim upstream advisory / workaround
3. SEC Consult SMTP smuggling research
4. oss-sec CVE announcement
5. Debian security tracker for CVE-2023-51766
6. Ubuntu security tracker for CVE-2023-51766
7. Public SMTP smuggling test tools
8. OpenCVE summary (KEV status surfaced)