CVE-2020-28247

CVE-2020-28247 concerns an argument injection vulnerability in the sendmail transport of the Rust lettre email library (all versions through 0.10.0-alpha).

The root cause lies in transport/sendmail/mod.rs, where the library builds the sendmail command-line invocation by directly interpolating email addresses as arguments. Instead of properly sanitizing or separating addresses from sendmail options, the code allows a crafted to address to inject arbitrary arguments into the sendmail command. This is a classic argument injection flaw, where user-controlled input (the recipient address) is passed unsafely to an external command.

Exploitation

An attacker can exploit this by sending an email to a specially malformed address, such as one containing command-line flags preceded by a dash. For example, depending on the sendmail implementation (original sendmail, Postfix, Exim, etc.), it may be possible to use flags like -O (set option) or -X (log to file) to redirect email content or logging to an arbitrary file. The attack requires no authentication, as the vulnerable option-sending occurs before any credential check. A remote attacker who can send an email through an application using the vulnerable SendmailTransport can trigger the injection.

Impact

Successful exploitation allows an attacker to write arbitrary data (the email body, headers, or log output) to a file of the attacker's choice on the system. The advisory lists categories as code-execution and file-disclosure, but the primary practical impact is file write, which could lead to remote code execution if the attacker can write to a location that affects program execution or configuration. The CVSS score is 5.3 (Medium) due to network attack vector, low attack complexity, and no privileges required, though confidentiality impact is listed as None.

Mitigation

The issue is patched starting from version 0.10.0-alpha.4, as well as in selected older branches (>=0.9.5, >=0.8.4, >=0.7.1). Applications using earlier versions should upgrade immediately. The fix involved properly escaping or separating arguments to the sendmail command. As of the latest releases, the library also supports alternative transports (SMTP) that are not vulnerable to this injection.

[1][2][4]