4 ms·
In summary¹: instead of sending CRLF.CRLF to end the email data part, send something like LF.CRLF and append more SMTP commands. The server accepting your email
by Aachen 3y ago
In summary¹: instead of sending CRLF.CRLF to end the email data part, send something like LF.CRLF and append more SMTP commands. The server accepting your email may interpret this as part of the body and forward it to a system which interprets it as the end of the body, with the rest being interpreted as more SMTP commands coming from a trusted system.
This allows you to relay arbitrary commands via this SMTP server and submit another email. An outbound relay may pass SPF (unlike your IP). A vulnerable inbound server may let you bypass certain checks (such as SPF, but perhaps also a malware filter) because the server you're talking to is trusted by the internal receiving server.
As an outbound example, Microsoft wouldn't allow you to pretend to be admin@hotmail or admin@another_customer_of_hotmail's when logging in with your regular user account and submitting an email, but this attack lets you submit two emails appearing as one to their initial system, so only the first one is validated.
¹ the article starts with a TL;DR but that doesn't actually mention what the vulnerability is, only how cool and widespread it is (I agree that it is cool and widespread, but that's not a TL;DR of a technical article, that's a dumbed-down executive impact overview). It then goes on a 1700-word lecture on how email and http works before telling you more about the issue.
- denton-scratch 3y ago> It then goes on a 1700-word lecture on how email and http works before telling you more about the issue. ...with every other sentence ending in an exclamation mark. It's a very badly targeted article. It reads like celebrity gossip, but the subject matter isn't for the kind of people that read that stuff. The people who are interested in this subject don't need their bottoms wiped for them. I bailed out halfway through. I still don't know what servers are vulnerable.
- Aachen 3y agoI also clicked through to an earlier article of theirs, about a dns issue. That was even harder to get through: I still don't understand the vulnerability exactly after reading the whole thing. It tries to explain every detail and somehow loses me in the weeds; I think a simple Python PoC would have been more clear than the long post. Compared to that, they're improving! This article is pretty clear about the mechanism once you get to it.
- deleted 3y ago[deleted]