GitHub Security Advisory: GHSA-54wq-72mp-cq7c
Package: github.com/axllent/mailpit (GO)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection'), CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences
Vulnerable versions: <= 1.28.2
Patched in: 1.28.3

Summary: Mailpit has an SMTP Header Injection via Regex Bypass

Details:
# Vulnerability Report: SMTP Header Injection via Regex Bypass

**Vulnerable Code:** `mailpit/internal/smtpd/smtpd.go`

## Executive Summary
Mailpit's SMTP server is vulnerable to **Header Injection** due to an insufficient Regular Expression used to validate `RCPT TO` and `MAIL FROM` addresses. An attacker can inject arbitrary SMTP headers (or corrupt existing ones) by including carriage return characters (`\r`) in the email address. This header injection occurs because the regex intended to filter control characters fails to exclude `\r` and `\n` when used inside a character class.

## RFC Compliance & Design Analysis
**"Is this behavior intentional for a testing tool?"**
No. While testing tools are often permissive, this specific behavior violates the core SMTP protocol and fails the developer's own intent.

1.  **RFC 5321 Violation:** The SMTP protocol strictly forbids Control Characters (CR, LF, Null) in the envelope address (`Mailbox`).
    *   *RFC 5321 Section 4.1.2:* A `Mailbox` consists of an `Atom` or `Quoted-string`. An `Atom` explicitly excludes "specials, SPACE and CTLs" (Control Characters).
2.  **Failed Intent:** The existence of `\v` in the regex `[^<>\v]` proves the developer **intended** to block vertical whitespace. The vulnerability is that `\v` in Go regex (`re2`) inside brackets `[]` matches *only* Vertical Tab, not CR/LF. If the design were to allow everything, the `\v` exclusion wouldn't exist.
3.  **Data Corruption:** Allowing `\r` results in the generation of malformed `.eml` files where the `Received` header is broken. This is not a feature; it's a bug that creates invalid email files.
4. RFC 5321 also enforces address lengths which are not applied in Mailpit.

## Technical Analysis

### The Flaw
The vulnerability exists in the regex definitions used to parse SMTP commands:

```go
// internal/smtpd/smtpd.go:32-33
rcptToRE   = regexp.MustCompile(`(?i)TO: ?<([^<>\v]+)>( |$)(.*)?`)
mailFromRE = regexp.MustCompile(`(?i)FROM: ?<(|[^<>\v]+)>( |$)(.*)?`)
```

The developer likely intended `[^<>\v]` to mean "Match anything that is NOT a `<` OR `>` OR `Vertical Whitespace`".

However, in Go's `regexp` (RE2) syntax, the behavior of `\v` changes depending on context:
- **Outside** brackets: `\v` matches all vertical whitespace: `[\n\v\f\r\x85\u2028\u2029]`.
- **Inside** brackets (`[...]`): `\v` matches **only** the Vertical Tab character (`\x0B`).

**Result:** The regex `[^<>\v]` **allows** Carriage Return (`\r`) and Line Feed (`\n`) characters to pass through, as they are not `<` or `>` or `\x0B`.

### Exploit Scenario
### Exploit Scenario
When Mailpit constructs the `Received` header, it uses the validated recipient address directly:

```go
// internal/smtpd/smtpd.go:865
buffer.WriteString(fmt.Sprintf("        for <%s>; %s\r\n", to[0], now))
```

If `to[0]` contains `victim\rINJECTED-HEADER: YES`, the resulting string in memory becomes:

```text
        for <victim\rINJECTED-HEADER: YES>; ...
```

While `bufio.ReadString` preve