MimeKit: CRLF Injection in Mail Addresses Can Harm Emails

Summary

MimeKit, a C# library used for creating and parsing email messages, had a bug that let attackers inject malicious code into email addresses. This could allow them to hijack emails or inject malicious content. The issue has been fixed in version 4.15.1, so make sure to update to this version or later.

What to do

Update mimekit to version 4.15.1.

Affected software

Vendor	Product	Affected versions	Fix available
–	mimekit	<= 4.15.0	4.15.1
–	mimekit	<= 4.15.1	4.15.1
jstedfast	mimekit	<= 4.15.1	–

Original title

MimeKit is a C# library which may be used for the creation and parsing of messages using the Multipurpose Internet Mail Extension (MIME), as defined by numerous IETF specifications. Prior to versio...

Original description

MimeKit is a C# library which may be used for the creation and parsing of messages using the Multipurpose Internet Mail Extension (MIME), as defined by numerous IETF specifications. Prior to version 4.15.1, a CRLF injection vulnerability in MimeKit allows an attacker to embed \r\n into the SMTP envelope address local-part (when the local-part is a quoted-string). This is non-compliant with RFC 5321 and can result in SMTP command injection (e.g., injecting additional RCPT TO / DATA / RSET commands) and/or mail header injection, depending on how the application uses MailKit/MimeKit to construct and send messages. The issue becomes exploitable when the attacker can influence a MailboxAddress (MAIL FROM / RCPT TO) value that is later serialized to an SMTP session. RFC 5321 explicitly defines the SMTP mailbox local-part grammar and does not permit CR (13) or LF (10) inside Quoted-string (qtextSMTP and quoted-pairSMTP ranges exclude control characters). SMTP commands are terminated by <CRLF>, making CRLF injection in command arguments particularly dangerous. This issue has been patched in version 4.15.1.

nvd CVSS4.0 6.9

Vulnerability type

CWE-93