Listen to this Post
The vulnerability stems from flawed regex patterns (rcptToRE and mailFromRE) in Mailpit’s SMTP command parser. The pattern `[^<>\v]` is intended to block control characters in email addresses. However, inside a regex character class in Go’s RE2 engine, `\v` matches only the vertical tab (\x0B), not carriage return (\r) or line feed (\n). This allows an attacker to inject `\r` into the `RCPT TO` or `MAIL FROM` address. When the address is later used to construct the `Received` header, the injected `\r` creates a “bare CR” that breaks the header line in the stored `.eml` file. Downstream mail systems interpreting the bare CR as a line terminator will process the following data as a new, injected SMTP header, leading to header injection and email corruption.
Platform: Mailpit
Version: Pre-fix versions
Vulnerability: Header Injection
Severity: Critical
date: 2024-01-13
Prediction: 2024-02-10
What Undercode Say:
$ grep -n "rcptToRE|mailFromRE" internal/smtpd/smtpd.go 32: rcptToRE = regexp.MustCompile(<code>(?i)TO: ?<([^<>\v]+)>( |$)(.)?</code>) 33: mailFromRE = regexp.MustCompile(<code>(?i)FROM: ?<(|[^<>\v]+)>( |$)(.)?</code>) $ go test -v -run TestRegex FAIL: TestRegexAllowlist (0.00s) smtpd_test.go:127: Character \r (0x0d) incorrectly allowed.
import socket
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("127.0.0.1", 1025))
payload = b"RCPT TO:<victim\rX-Injected: Yes>\r\n"
s.send(payload)
How Exploit:
Send SMTP commands with `RCPT TO:`.
The carriage return breaks the `Received` header line.
Corrupt `.eml` file is stored.
Downstream mail parsers may process the injected text as a new header.
Protection from this CVE:
Update regex to `[^<>\x00-\x1f]`.
Apply strict SMTP RFC 5321 compliance.
Validate envelope addresses for control characters.
Impact:
SMTP header injection.
Email file corruption.
Potential downstream parsing issues.
False security sense for developers.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
