Researchers from SEC Consult have published a new spoofing technique caused by inconsistencies in the adherence to specifications across different implementations of the SMTP protocol. The proposed attack method allows a single message to be split into several different messages when transmitted from one SMTP server to another, which interprets the sequence for separating messages transmitted over a single connection differently. This method can be used to send fake emails on behalf of other senders in email services that verify the original sender.
The problem arises because different SMTP servers interpret the end-of-data sequence differently, which can lead to splitting a single email into several during a single session with the SMTP server. The specification defines the sequence for marking the end of an email transmission as ‘\r\n.\r\n’ (a period surrounded by carriage return and newline characters). After this sequence, commands for sending another email can follow without breaking the connection. Some SMTP servers strictly adhere to the specification, while others, to ensure compatibility with certain rare email clients, treat sequences like ‘\n.\n’, ‘\n.\r\n’, ‘\r\n.\n’, ‘\r.\r’, ‘\r\n\0.\r\n’, and ‘\r\n\0.\r\n’ as delimiters.
The attack hinges on the fact that an email is sent to a first server, which only processes the delimiter ‘\r\n.\r\n’, while the body contains an alternative delimiter, such as ‘\r.\r’, followed by commands to send the second message. serverSince the first server strictly follows the specification, it treats the received sequence as a single email. If the email is then sent to a transit server or the recipient's server, which also perceives the sequence ‘\r.\r’ as a delimiter, it will be processed as two separately sent emails (the second email can be sent on behalf of a user who is not authenticated via ‘AUTH LOGIN’, but will appear legitimate to the recipient).
Examples of SMTP servers and services that allow alternative delimiters include Postfix, Sendmail, MS Exchange Online, and Cisco Secure Email Gateway. Among the email services that do not filter incorrect delimiters from messages when communicating with other servers are GMX, iCloud, and Microsoft Outlook.
To block issues in Postfix, releases 3.8.1, 3.7.6, 3.6.10, and 3.5.20 have introduced the setting ‘smtpd_forbid_unauth_pipelining’, which disconnects the connection if delimiters do not meet the requirements of RFC 2920 and RFC 5321. Currently, this setting is disabled by default, but it is planned to be enabled by default in the Postfix 3.9 branch, expected in spring 2024. The 3.9 branch will also include the smtpd_forbid_bare_newline setting, which will produce an error when using only the newline character (‘\n’) to separate lines, violating RFC 5321.
In the upcoming release of Sendmail 8.18.0.2, for protection against attacks, an option ‘o’ has been proposed in srv_features that enables processing only the sequence ‘\r\n.\r\n’. It is noted that disabling support for alternative delimiters may disrupt the operation of some rare email clients that do not fully comply with the SMTP specification.
Source: opennet.ru
