CVE-2020-37248: OfflineIMAP STRIPTLS Vulnerability – Credential Exposure Risk

Technical summary

CVE-2020-37248 exploits improper trust of STARTTLS capability announcements in OfflineIMAP's IMAP protocol handling. The vulnerability stems from CWE-348 (Mismatched Entities in Authentication), where the client fails to authenticate the server's STARTTLS offering before committing credentials to the session. An attacker positioned on the network path (AV:N) can strip or suppress the STARTTLS advertisement, forcing the client to transmit authentication credentials over an unencrypted connection. The attack requires moderate complexity (AC:H) due to the need for network positioning and timing, but succeeds without user interaction (UI:N) and affects confidentiality severely while causing minor integrity impact.

Business impact

Organizations and individuals using OfflineIMAP for email synchronization face credential compromise. An attacker capable of intercepting network traffic—such as on shared WiFi, compromised networks, or via BGP hijacking—can harvest email account credentials. Once obtained, these credentials enable unauthorized email access, data exfiltration, account takeover, and potential pivot into corporate systems if those credentials are reused. The risk is heightened in remote work scenarios where users connect via untrusted networks.

Affected systems

OfflineIMAP versions prior to 8.0.3 are affected. Users running version 8.0.3 or later are protected. The vulnerability applies to any deployment of the affected versions that connects to IMAP servers, including personal email accounts, corporate mail systems, and automated synchronization workflows. Systems using OfflineIMAP on public or untrusted networks are at highest risk.

Exploitability

The vulnerability is exploitable by attackers with network access to the target (requiring an on-path position relative to the OfflineIMAP client and mail server). No authentication, user interaction, or special privileges are required. The attack does not require code execution on the target system. The moderate complexity rating reflects the practical difficulty of reliably positioning oneself on the network path in many environments, but once positioned, exploitation is straightforward. This is not currently tracked as exploited in the wild according to CISA's Known Exploited Vulnerabilities catalog, though the technique itself (STRIPTLS) is well understood in the security community.

Remediation

Upgrade OfflineIMAP to version 8.0.3 or later. Verify the upgrade by checking the version string in the application or changelog. Additionally, users should adopt network-level mitigations: use VPNs when connecting from untrusted networks, ensure IMAP servers enforce TLS (not optional STARTTLS), and monitor email accounts for unauthorized access. Consider implementing certificate pinning in OfflineIMAP configuration if available.

Patch guidance

Download OfflineIMAP version 8.0.3 or later from the official repository. Before deployment, verify the integrity of the package using GPG signatures if provided by the project. Test the upgrade in a non-production environment first to ensure compatibility with your mail server and local mail store. After upgrading, verify that TLS connections are being established by checking debug logs or network monitoring. No configuration changes are required for the fix to take effect, though enabling strict TLS policies on the mail server side provides defense-in-depth.

Detection guidance

Monitor OfflineIMAP version numbers across your infrastructure using software inventory tools. On endpoints running OfflineIMAP, enable debug logging (typically via -d option) and search logs for 'STARTTLS' and 'TLS' keywords to confirm encryption is negotiated. Network detection is challenging but monitoring for unexpected cleartext IMAP authentication (port 143 vs. encrypted port 993) can indicate downgrade attacks. Email security teams should monitor for suspicious login patterns (new geographies, unusual times, rapid credential use) that might indicate harvested credentials from STRIPTLS attacks.

Why prioritize this

Although rated MEDIUM severity, this vulnerability warrants prompt attention because credential compromise is a severe business consequence. Organizations should prioritize patching in environments where users connect from untrusted networks or where the affected OfflineIMAP instances sync sensitive corporate email accounts. Environments with robust VPN or network segmentation policies may defer slightly, but the fix is straightforward and carries low risk, making early patching practical.

Risk score, explained

CVSS 3.1 score of 6.5 (MEDIUM) reflects high confidentiality impact (account credentials exposed) and low integrity impact (connection takeover), affecting the target's systems (S:U) with no availability impact. The Network attack vector (AV:N) and High complexity (AC:H) balance each other; while the attacker must be on the network path, that requirement is attainable in many real-world scenarios (public WiFi, ISP-level access, compromised routers). The lack of authentication or user interaction (PR:N, UI:N) requirements elevates the score. The rating appropriately reflects that this is a serious credential-stealing vulnerability mitigated only by network positioning difficulty.

Frequently asked questions