JavaMail allows injection of unwanted headers

[glassfishrobot]

Applications that do not provide sufficient validation on some fields used to compose emails may be vulnerable to unwanted header injection when sending emails.

In particular, when an application allows the user to specify a "from" name and that name has a newline character embeded, the raw email stream arriving at the destination may see the line following the newline character as a header within the email stream.

For example:

MimeMessage msg = new MimeMessage(someSession);

InternetAddress fromAddress = new InternetAddress("My Name \nX-SomeHeader: somedata", "myrealaddress@foo.com");

msg.setFrom(fromAddress);

msg.send();

When Javamail emits the "from" header into the stream, it will look like this:

From: "My Name
X-SomeHeader: somedata" myrealaddress@foo.com

This will give the receiving system a bogus "From" header as well as an injected "X-SomeHeader" header.

Depending on how the receiving system behaves and the injected header itself, it may be possible for an attacker to cause unwanted or unauthorized behavior on the receiving system.

Affected Versions

1.5.5

Environment

PC
Linux

[glassfishrobot]

@glassfishrobot Commented
Reported by rstevens_sf

[glassfishrobot]

@glassfishrobot Commented
@bshannon said:
The JavaMail javadocs have always made it clear that applications are responsible
for validating input before passing it to JavaMail API methods. Still, some
developers are confused about this or never read the documentation.

I've enhanced JavaMail for 1.5.6 to ensure that newlines in headers that are
folded (address headers, Subject, Content-Type, Content-Description, ...)
are always followed by whitespace to prevent possible header injection.
Applications that manipulate headers directly will still need to handle this
themselves.

[glassfishrobot]

@glassfishrobot Commented
This issue was imported from Bugzilla JAVAMAIL-7529

[glassfishrobot]

@glassfishrobot Commented
Marked as fixed on Tuesday, May 2nd 2017, 1:27:00 pm

[glassfishrobot]

• Issue Imported From: https://github.com/javaee/javamail/issues/222
• Original Issue Raised By:@glassfishrobot
• Original Issue Assigned To: @bshannon
• Original Issue Closed By:@glassfishrobot