Severity: Medium Test name: Email Header Injection
Some web applications allow users to send email messages via contact forms to defined recipients. In most cases, such contact form scripts set headers. Afterwards, the headers are converted into SMTP commands, which are then processed by the SMTP server.
Email Header Injection allows an attacker to insert additional malicious headers into the email message via unsafe user input. As a result, these headers will be converted into SMTP commands and processed by the SMTP server.
This vulnerability may lead to:
Sending spam emails.
Phishing and spoofing attacks. The recipient is made to believe that the email is legitimate. The email usually redirects the victim to a malicious website, which then steals their credentials or infects their computer with malware (via a drive-by-download).
Denial of Service if the attacker sends a huge amount of emails, so the SMTP server can be overloaded.
Example of a spam email
Let’s imagine the following code is used on the server side for sending an email message:
As a result, the attacker can send a large number of messages anonymously. The attacker may also send phishing emails, where the recipient believes that these messages are originating from a trusted source (your website).
The issue can be found in the source code on the server side.
Sanitize user input with special functions according to your programming language. In particular, input containing newlines and carriage returns should be rejected.
Use certain correct types for supplied user input such as string, float or int. If your application expects an email address, it should be validated with Email pattern.
Alternatively, consider switching to an email library that automatically prevents such attacks. Use the latest version and upgrade your email library periodically.