SMTP Header Injection

Question

I'm trying to understand SMTP header injection. I'm using Python's SMTPLIB library to proto-type this vulnerability. Here is my code:

import smtplib

# create variables
server = 'smtp.zoho.com'
port = 587
to = 'recipient@test.com'
user = 'sender@test.com'
passwd = 'pwd'
smtpserver = smtplib.SMTP(server, port)


def mail():
    smtpserver.ehlo()
    smtpserver.starttls()
    smtpserver.ehlo
    smtpserver.login(user, passwd)
    header = 'To:' + to + '\n' + 'From: ' + user + '\ncc:victim@test.com\n' + 'Subject:testing \n'
    msg = header + '\n test 5 \n\n'
    smtpserver.sendmail(user, to, msg)
    print header + 'done!'
    smtpserver.close()

# call mail method
mail()

I've tried using the Zoho and Gmail SMTP server. The email is successfully sent to the address in the "to" variable, but it is not sent to the "victim@test.com" email address. When I view the message in Gmail or Zoho I do see the "victim@test.com" in the CC field, but it never gets sent to the second email address. I've also tried to inject the Subject field with the same results.

Can someone explain this to me? Is this some filtering done on Gmail/Zoho's end?

Thanks, Johnny_v

Answer 1

Simple case: You do not send the email to victim@test.com.

The headers of the email are not used by the SMTP server.

You add a CC: to the email header but the SMTP server does not read this header.

The SMTP server only sees what you transmit with your line smtpserver.sendmail(user, to, msg).

Basically the communication is as follows (S: server, C: client) (the TLS and authentication part is left out) (parts in brackets [] are comments by me) based on your script:

C: EHLO
S: 220 smtp.zoho.com
C: MAIL FROM: <sender@test.com> [the address user]
S: 250 OK
C: RCPT TO: <recipient@test.com> [the address to]
S: 250 OK
C: DATA [your msg follows]
   To: recipient@test.com
   From: sender@test.com
   cc:victim@test.com
   Subject:testing 
    test 5 


   .
S: 250 OK
C: QUIT
S: 221 Good Bye

The mail server only respects the part RCPT TO:. Everthing else (between DATA and .) is only data and no scanned/parsed by the SMTP server.

To send the email to someone else you have to add a second command with RCPT TO:. This must be done with another call to smtpserver.sendmail(). As I don't know the library used I cannot tell you if you have to create a second call or if there is a call with a list of recipients.

Note also that you can send the email to someone without adding the recipient to the header (this is used for BCC for example).

Answer 2

The most common form of SMTP header injection is adding a To:, CC:, or BCC: header to send the email to an unintended recipient. This works with SMTP libraries that take a complete email with headers and parse it to figure out the recipients (most notably, the command-line sendmail invoked with the -t option and some invocations of the PHP mail() function).

Python's SMTPLIB is resistant to this: SMTP.sendmail() requires an explicit list of recipients, so changing the headers will only change the apparent list of recipients. This is because the email delivery process (apart from possibly the originating client) ignores the headers, and delivers to the "envelope To:" address (RCPT TO: in the SMTP conversation).

Answer 3

As Uwe Plonius explained, the article seems wrong in its explanation, however to me the concept remains valid.

Instead of the 20 sources cited in this article, I will rely only on one: RFC 821, section 3, defining the mail sending procedure.

Two things need to be noted there:

• Each command must end with a <CRLF>, and not just <LF> as in your document. The correct end of line will therefore be "\r\n",
• The mail server must accept at least up to 100 recipient for a single mail (the number 100 being imposed section 4.5.2 SIZES defining the "required minimum maximum" size for the recipients buffer), each on will be specified using a separate "RCPT TO:" command.

On a vulnerable server, you may therefore achieve the requested exploit by forging an email address, either as principal recipient or copy, containing an injected "RCPT TO:" command as follow:

to = "recipient@test.com>\r\nRCPT TO:<victim@test.com"

For this vulnerability to be effective, you need at least the two prerequisites:

• Your recipient address will not be filtered before reaching the server, the carriage return and line feed characters being invalid for a destination address,
• The SMTP server implementation tolerates that you already send the next "RCPT TO:" command without waiting the server feedback.