zakirkun Email Header Injection
Overview
Email header injection (also known as SMTP header injection) allows attackers to inject additional To:, CC:, BCC: headers or modify the message by inserting CRLF sequences (\r\n) into email fields. This turns the application into a spam relay.
Attack: Setting the "From name" to victim@example.com\r\nBCC: spam@list.com adds a blind carbon copy to all sent emails.
Remediation
- Strip
\r,\nfrom all user-supplied email header values - Use email library functions that automatically prevent injection
- Never concatenate user input directly into SMTP headers