GHSA-g7hc-96xr-gvvx: MimeKit has CRLF Injection in Quoted Local-Part that Enables SMTP Command Injection and Email Forgery
SummaryA CRLF Injection vulnerability in MimeKit 4.15.0 allows an attacker to embed `\r\n` into the SMTP envelope address local-part (when the local-part is a quoted-string). This is non-compliant with RFC 5321 and can result in SMTP command injection (e.g., injecting additional `RCPT TO` / `DATA` / `RSET` commands) and/or mail header injection, depending on how the application uses MailKit/MimeKit to construct and send messages. The issue becomes exploitable when the attacker can influence a `MailboxAddress` (MAIL FROM / RCPT TO) value that is later serialized to an SMTP session.RFC 5321 explicitly defines the SMTP mailbox local-part grammar and does not permit CR (13) or LF (10) inside `Quoted-string` (qtextSMTP and quoted-pairSMTP ranges exclude control characters). SMTP commands are terminated by `<CRLF>`, making CRLF injection in command arguments particularly dangerous.Details1) RFC 5321 local-part grammar prohibits CR/LF in quoted-stringRFC 5321 defines:When the local part is a quoted string, the characters <CR> and <LF> are not allowed.2) MimeKit 4.15.0 accepts CR/LF inside quoted local-part (non-compliant)In the MimeKit 4.15.0 version, when parsing the local part, the <CR> and <LF> characters in the double-quoted form will not be detected.
As a result, `MailboxAddress` can accept addresses like `"attacker\r\nRCPT TO:<victim@target>\r\n"@example.com` as a valid address.3) Affected components / versionsMimeKit 4.15.0 (as tested)MailKit 4.15.0 uses/depends on MimeKit 4.15.0
Any application that:Accepts untrusted input for sender/recipient addresses, andConstructs `MailboxAddress` from that input, andSends via SMTP (e.g., using MailKit SmtpClient),
may be impacted.PoCEnvironment:.NET SDK: 8.0.418Target Framework: net8.0Packages: MailKit 4.15.0 (with MimeKit 4.15.0)Use ProtocolLogger to capture the SMTP session and confirm injection.Create a minimal project:mimekit_poc.csprojPoC program (replace SMTP host/port/address as needed):Expected result`MailboxAddress` accepts the injected addr-spec containing CRLF inside the quoted local-part because it relies on quoted-string skipping that does not reject CR/LF.The generated SMTP session (captured by ProtocolLogger) shows the `MAIL FROM` line being split by the injected CRLF, followed by attacker-controlled SMTP commands.`tcpdump` also shows the same raw SMTP stream (optional confirmation).Example (illustrative) excerpt from smtp session log showing the CRLF injection effect:Notes:Whether the server executes the injected commands depends on server-side parsing/validation and SMTP pipeline state, but the client-side behavior (emitting CRLF into SMTP command stream via `MailboxAddress`) is sufficient to demonstrate the vulnerability class and protocol non-compliance.SMTP commands are terminated by `<CRLF>`, so CRLF-in-argument is structurally hazardous by design.ImpactVulnerability class:SMTP command injection / CRLF injection via envelope address (MAIL FROM / RCPT TO).Protocol non-compliance with RFC 5321 local-part grammar for quoted-string (CR/LF not allowed).Who is impacted:Any application using MimeKit/MailKit to send email over SMTP where mailbox addresses are influenced by untrusted input (e.g., user-supplied “From” address, tenant-configurable sender identity, inbound-to-outbound forwarding rules, contact imports, webhook-driven mail sending, etc.).Potential consequences:Add or modify SMTP recipients by injecting extra `RCPT TO` commands (mail redirection / data exfiltration).Corrupt the SMTP transaction state (`RSET`, `NOOP`, etc.) or attempt early `DATA` injection (server-dependent).In some environments, may enable header injection if the attacker can pivot from envelope manipulation into message content workflows (application-dependent).Logging/auditing evasion or misleading audit trails if the SMTP transcript is altered by injected command boundaries.Suggested remediation (high level):Reject `\r` and `\n` in local-part (and ideally anywhere) when parsing/constructing mailbox addresses used for SMTP envelopes.Align quoted local-part parsing with RFC 5321’s `qtextSMTP` and `quoted-pairSMTP` ranges (no control characters).
CVSS v4.0: 6.9