[prev in list] [next in list] [prev in thread] [next in thread] 

List:       oss-security
Subject:    Re: [oss-security] Re: New SMTP smuggling attack
From:       Harry Sintonen <sintonen () iki ! fi>
Date:       2023-12-22 23:33:13
Message-ID: d23e7dd0-eb16-046d-b418-ef130a2ccd4f () iki ! fi
[Download RAW message or body]

On Fri, 22 Dec 2023, Stuart D Gathman wrote:

> On Sat, 23 Dec 2023, Alexander E. Patrakov wrote:
>
>>> I'm trying to make sense of it - where's the compromise of the
>>> Confidentiality, Integrity or Availability of the affected mail
>>> servers?
>>> 
>> 
>> The integrity of the sender's identity, as a minimum, is compromised
>> here. Normally, when relaying mail, servers add a "Received:" header
>> that specifies where they received the connection from. This allows
>> tracking down the true origin of the message. The smuggled message
>> does not have such a header and thus misrepresents the vulnerable
>> relay as the ultimate sender. Additionally, if the relay has
>> destination-based deny lists that deny some but not all addresses on
>> the destination domain, they are sidestepped.
>
> This is certainly a bug, but the currently reality is that
> authentication involves SPF, DKIM, and other schemes - and does not
> solely rely on headers.  So can this "delete some headers" attack
> compromise these authentication schemes?

This is the key here: These validation schemes will act on other data 
(which the attacker provides, and is valid). Hence the email passes these 
validations and continues in the delivery chain.

Now comes the actual smuggling bug: Since the parsing of <CR><LF> is 
buggy, a forged message (will different details) will actually get 
delivered.

This is all described in detail in the excellent SEC Consult advisory.


   Regards,
-- 
l=2001;main(i){float o,O,_,I,D;for(;O=I=l/571.-1.75,l;)for(putchar(--l%80?
i:10),o=D=l%80*.05-2,i=31;_=O*O,O=2*o*O+I,o=o*o-_+D,o+_+_<4+D&i++<87;);puts
("  Harry 'Piru' Sintonen <sintonen@iki.fi> https://www.iki.fi/sintonen");}
[prev in list] [next in list] [prev in thread] [next in thread]