mail-mime-parser CRLF header injection when building email
Email-building software can be made to secretly add hidden recipients.
Summary
The mail-mime-parser library does not strip CR and LF characters from some values it writes into email headers, so an attacker can inject extra lines such as a forged Bcc. Applications that pass untrusted values into these message-building methods are affected.
Affected when
- Untrusted input passed unfiltered as MIME type, charset, encoding, micalg or protocol
What to do
Update to 3.0.9 for the 3.x line or 4.0.6 for the 4.x line. Until then, strip CR and LF from externally influenced values before passing them in.
Update to at least the version for your product:
- zbateson mail-mime-parser 3.x 3.0.9 or later
- zbateson mail-mime-parser 4.x 4.0.6 or later
Products and platforms
CVE IDs
Sources
- Advisory: github.com (opens in a new tab)
- Write-up: github.com (opens in a new tab) · vulncheck.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen