Vulnerabilidad · Publicado 08/10/2026
Progressive Robot hMailServer versiones 6.0.0 a 6.3.5 contienen deficiencias en la validación de encabezados HTTP y falta de limitación de intentos fallidos en su API REST, permitiendo ataques de DNS rebinding para comprometer credenciales de administrador. Empresas en LATAM que utilizan este servidor de correo son vulnerables a toma de control administrativo si el listener REST está habilitado, incluso en configuraciones de loopback.
Missing Host header validation and missing throttling of failed administrator sign-ins in the REST API listener of Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a remote attacker to brute-force the server administrator's password through the administrator's own browser by DNS rebinding. The listener, which is off by default and bound to the loopback when enabled, answered requests whatever their Host header named, and a failed sign-in with the administrator's password from the loopback was neither auto-banned nor delayed. A web page whose host name the attacker rebinds to 127.0.0.1, opened in a browser on the server, can therefore send authenticated requests to the listener, read the answers and try administrator passwords at full speed until one is accepted, giving the attacker full administrative control of the mail server.
Score: 7.5/10 — Severidad: HIGH — Estado NIST: Received
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-346
Publicado en NIST NVD.