CRLF Injection vulnerability in "email.mime.multipart" > "MIMEMultipart" > "add_header()"

Summary

I found CRLF Injection ( File Content Injection / (Potential) Tampering file extension ) Vulnerability in email.mime.multipart > class MIMEMultipart > add_header().

This problem is caused by the lack of escaping of "filename" in Multipart > Mail.
Normally, the following three characters are escaped

• \r --> \\r
• \n --> \\n
• " --> \"
  However, the method in question does not escape \r\n
  ( " (double-quote) is escaped. " --> \" )

Therefore, if a crafted file name is inserted, CRLF Injection will occur in the Content-Disposition header of multipart body.

My calculated CVSS:
Score: 3.1 (Low)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

---

PoC:

OS: macOS Monterey (v12.6.1)
Python ver: v3.10.3
PoC Code:
(please edit filepath)

from email.mime.application import MIMEApplication
def main():
  filepath = "/Users/XXXXXXXXXX/Desktop/example.txt"
  # If \r\n (CRLF) is present, the file will fail to load (on mac OS).
  with open(filepath, "rb") as f:
    mb = MIMEApplication(f.read())
  disposition_filename = "malicious_test.sh\r\n.txt"
  # If \r\n (CRLF) is present, the contents of the file can be Injected.
  mb.add_header("Content-Disposition", "attachment", filename=disposition_filename)
  print(mb)
if __name__ == '__main__':
  main()

Output:

Content-Type: application/octet-stream
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="malicious_test.sh
.txt"
IyEvYmluL2Jhc2gKCmVjaG8gImhlbGxvIg==

Injected Line:

Content-Disposition: attachment; filename="malicious_test.sh
.txt"

---

Affect

This problem is very limited.
The reason for this is that if [ \r, \n ] are included when a file is opened, an Exception will be thrown.

with open(filepath, "rb") as f:

However, it is not always safe to do so, since the file name may be given by an external parameter, DB, etc.
In addition, data can be added to the header content within Multipart, allowing for a variety of attacks.

It may be possible to insert multiple Content-Dispositions, falsify the filename, or inject malicious shell code after making the file .sh .

---

Reference:

As far as I can tell, the following service systems escape [ \r \n " ] to [ \\r \\n \" ]

• Gmail
• Thunderbird
• mailer (Mac OS default mail client)
• PHPMailer (Most famous PHP Mail library https://github.com/PHPMailer/PHPMailer)

---

The Python PSRT team has agreed to published this information.

Bắt đầu từ đường dẫn email.mime.multipart MIMEMultipart.add_header() và tái hiện PoC được cung cấp với một filename chứa CRLF. Theo dõi cách filename được tuần tự hóa vào header Content-Disposition, sau đó thêm kiểm thử hồi quy cho hành vi được báo cáo; được xem là hoàn tất khi CRLF được tạo có chủ đích không thể tạo thêm các dòng header và hành vi MIME hiện có vẫn nguyên vẹn.