Re: SMTP Smuggling

On Tue, 16 Jan 2024 08:42:08 +0000
Christoph Mitasch via courier-users
<[email protected]> wrote:

> is Courier MTA affected by the new SMTP smuggling attack?
> https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/

Hi,

I have asked myself the same question right after the SMTP
Smuggling research came out.

The short answer is: Courier is probably not vulnerable.

The slightly longer answer is: It's complicated, there's probably room
for improvement, and there are things that should be further
investigated.
I wanted to share some info, but haven't found the time yet to dig
deeper into this. But as you ask, here's my preliminary findings.

FWIW, I released a python script that allows running some tests related
to SMTP smuggling:
https://github.com/hannob/smtpsmug
Caveat: The script is not a simple "tell me if this is
vulnerable"-tool, the results need to be interpreted, and for some
issues you need to look at the receiving side.

SMTP smuggling essentially requires both sending and receiving servers
to misbehave. To be not vulnerable (on both sides), a server must avoid
accepting invalid end of data signals (<cr><lf>.<cr><lf> is valid,
everything else is invalid) and must avoid to forward invalid end of
data signals (e.g. <cr>.<cr> or <lf>.<lf> or any other weird
combination of line endings).

Courier does neither. However, courier accepts single <cr> or <lf>
characters, which is invalid SMTP, but it converts them in all cases I
have tested into something that does not cause a vulnerability as far
as I can tell.

It would probably be better if courier would reject such single
characters and answer with an error, as valid SMTP does not allow them.
(These characters always must come as a <cr><lf> pair.)

Furthermore, I have observed some unexpected behavior when injecting
invalid end of data signals with null bytes, but I haven't looked into
this further. (Courier would open a connection and send an rset, which
my debugging receiving SMTP poc server did not support, and at that
point I haven't analyzed further.)

-- 
Hanno Böck
https://hboeck.de/


_______________________________________________
courier-users mailing list
[email protected]
Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users