🇰🇷 한글 설명
Progressive Robot hMailServer 6.3.3~6.3.7의 웹 서비스 리스너가 자동 차단된 IP 범위를 적용하지 않아, 원격 미인증 공격자가 차단 이후에도 계정 로그인 시도를 계속할 수 있습니다. 이 리스너는 기본적으로 비활성화되어 있으며, 자동 차단 방화벽 규칙 및 fail2ban 설정도 해당 포트를 포함하지 않아 무차별 대입 공격이 제한되지 않습니다.
💡 쉬운 설명
hMailServer의 웹 서비스 기능이 차단된 공격자의 접속을 막지 못합니다. 그래서 공격자가 차단 후에도 계정 비밀번호를 계속 추측할 수 있습니다.
🇺🇸 원문 (English)
The web services listener of Progressive Robot hMailServer 6.3.3 through 6.3.7 does not apply the server's IP ranges to the connections it accepts, which allows a remote unauthenticated attacker to go on guessing account passwords at the listener's sign-ins after the auto-ban has banned the attacker's address. The listener is off by default (WebServicesHttpPort and WebServicesHttpsPort 0). From 6.3.3 its CardDAV, and from 6.3.4 its CalDAV and its Outlook Autodiscover answer to a request that carries credentials, sign an account in with HTTP Basic over HTTPS. A failed sign-in there counts towards the auto-ban as a failed logon on any other protocol does: when the failures counted from one address reach MaxInvalidLogonAttempts (3 within 30 minutes by default), the server writes an IP range that refuses the address for AutoBanMinutes (60 by default), and the SMTP, POP3, IMAP and ManageSieve listeners refuse it. The web services listener asked no IP range when it accepted a connection (in 6.3.3 nothing, from 6.3.4 the country policy alone), so it went on serving such an address, whether its ban had been earned there or on another protocol, and also an address that an administrator's IP range allowing nothing holds. Each failed sign-in there closed only its own connection, and the next connection was accepted, during the ban and after it. The firewall rule and command the auto-ban can drive (AutoBanFirewall and AutoBanCommand, off by default) are told only the SMTP, POP3 and IMAP ports, so that the firewall rule and the packaged hook did not close the listener's ports, and the fail2ban jail packaged for Linux (off by default) lists only the mail and ManageSieve ports. The only limit left on the guesses at one account there was the per-name lockout (AccountLockoutThreshold in hMailServer.ini, 0, off, by default), which has a separate defect fixed in the same release. The flaw is reached on the listener's HTTPS port: behind a TLS-terminating proxy the listener sees the proxy's address for every client, and a ban never named the client there.
📍 영향받는 시스템
hMailServer 6.3.3 ~ 6.3.7 (웹 서비스 리스너 활성화 시, HTTPS 포트 기준)
⚔️ 공격 벡터
차단된 IP에서 hMailServer 웹 서비스(CardDAV/CalDAV/Autodiscover) HTTPS 포트로 Basic 인증 로그인을 반복 시도하여 계정 비밀번호를 무차별 대입
🛡️ 대응 방법
hMailServer를 6.3.8 이상으로 업그레이드하고, 웹 서비스를 사용하지 않으면 WebServicesHttpPort와 WebServicesHttpsPort를 0으로 유지하며, 계정 잠금(AccountLockoutThreshold)을 설정하세요.
🔧 검증 코드
WebServicesHttpPort/WebServicesHttpsPort가 0이면 웹 서비스가 비활성화되어 있어 영향이 없고, 0이 아닌 포트 값이 나오면 웹 서비스가 활성 상태이므로 버전 확인 및 업그레이드가 필요하며, AccountLockoutThreshold가 0이면 계정 잠금이 꺼져 있는 상태입니다.
grep -iE 'WebServicesHttp(s)?Port|AccountLockoutThreshold' "$(find / -name hMailServer.ini 2>/dev/null | head -1)" 2>/dev/null