CVE-2023-51764
MEDIUMPostfix < 3.5.23 - SMTP Smuggling via Bare Newline Injection
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-2023-51764. PoCs published by duy-31, eeenvik1, d4op.
AI-analyzed exploit summary This is a working proof-of-concept exploit for CVE-2023-51764, demonstrating SMTP smuggling in Postfix. It leverages the vulnerability to send multiple spoofed emails within a single legitimate email, bypassing SPF/DKIM/DMARC checks for the nested emails.
Description
Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain other options that exist in recent versions). Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Postfix supports <LF>.<CR><LF> but some other popular e-mail servers do not. To prevent attack variants (by always disallowing <LF> without <CR>), a different solution is required, such as the smtpd_forbid_bare_newline=yes option with a Postfix minimum version of 3.5.23, 3.6.13, 3.7.9, 3.8.4, or 3.9.
Exploits (4)
This is a working proof-of-concept exploit for CVE-2023-51764, demonstrating SMTP smuggling in Postfix. It leverages the vulnerability to send multiple spoofed emails within a single legitimate email, bypassing SPF/DKIM/DMARC checks for the nested emails.
The repository contains two Python scripts demonstrating SMTP smuggling (CVE-2023-51764) by exploiting Postfix's handling of SMTP commands. The scripts send emails with spoofed sender addresses via ports 25 and 465, leveraging improper command injection in the email body.
This PoC demonstrates SMTP smuggling (CVE-2023-51764) by exploiting improper handling of SMTP commands to spoof emails. It sends multiple emails with forged sender addresses by manipulating the SMTP protocol flow.
This PoC exploits CVE-2023-51764, an SMTP authentication bypass vulnerability, by sending crafted AUTH PLAIN commands to spoof sender/recipient emails. It uses an Expect script to automate the interaction with the SMTP server.
References (19)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N