curl · Report #3911605
SMTP CRLF injection in custom SMTP recipient operand allows additional SMTP commands after authentication
How it was found
Summary
During testing of curl 8.18.0, I observed that CRLF characters embedded in the SMTP recipient operand used with a custom SMTP request are transmitted as additional SMTP commands.
The injected commands are accepted and processed after successful SMTP authentication, allowing multiple SMTP commands to be executed within the same authenticated session.
Product
curl CLI
Version tested:
curl 8.18.0
Release-Date: 2026-01-07
Environment
- OS: Kali Linux
- curl: 8.18.0
- SMTP AUTH: PLAIN
Steps to Reproduce
-
Configure curl to perform an authenticated SMTP session using a custom SMTP request (EXPN).
-
Supply a recipient operand containing embedded CRLF characters followed by additional SMTP commands.
Example payload structure:
Friends\r\n
MAIL FROM:<[email protected]>\r\n
RCPT TO:<[email protected]>\r\n
DATA\r\n
Subject: injected\r\n
\r\n
curl-smtp-injection-marker-v1\r\n
.
- Execute the SMTP request.
Observed Behavior
The SMTP session authenticates successfully.
Instead of treating the recipient operand as a single parameter, curl transmits the embedded CRLF characters, causing the SMTP server to interpret the following data as additional SMTP commands.
Observed command sequence:
EHLO probe
AUTH PLAIN
EXPN Friends
MAIL FROM:<[email protected]>
RCPT TO:<[email protected]>
DATA
Subject: injected
curl-smtp-injection-marker-v1
.
QUIT
The SMTP server accepted the injected transaction and completed the DATA phase successfully.
Expected Behavior
CR and LF characters should not be permitted inside the SMTP recipient operand.
The value should be validated before serialization so it cannot terminate the current SMTP command and inject additional commands.
Evidence
The attached screenshots demonstrate:
- curl version
- Successful authenticated SMTP session
- Additional injected SMTP commands
- Successful completion of the injected DATA transaction
- Marker confirming successful command injection
Impact
An application that passes attacker-controlled input into the SMTP recipient operand while using custom SMTP requests may unintentionally execute additional SMTP commands within an authenticated SMTP session.
Depending on the application's usage of libcurl/curl, this may allow unintended SMTP operations.