MimeKit: CRLF Injection in Quoted Local-Part Enables SMTP Command Injection and Email Forgery

Vulnerability

Overview

MimeKit, a .NET MIME library, prior to version 4.15.1 contains a CRLF injection vulnerability in its handling of quoted-string local-parts in SMTP envelope addresses. According to the advisory [2], the library accepts carriage return (CR) and line feed (LF) characters inside quoted local-parts, which violates RFC 5321. The RFC explicitly prohibits control characters in the qtextSMTP and quoted-pairSMTP ranges, making this a non-compliant behavior that opens the door to injection attacks.

Exploitation

The vulnerability becomes exploitable when an attacker can influence a MailboxAddress value (used for MAIL FROM or RCPT TO) that is later serialized into an SMTP session [3]. By embedding \r\n sequences into the local-part, the attacker can inject arbitrary SMTP commands—such as additional RCPT TO, DATA, or RSET commands—or inject mail headers. No authentication is required if the application accepts user-supplied email addresses and passes them to MimeKit for serialization.

Impact

Successful exploitation allows an attacker to perform SMTP command injection, potentially leading to email forgery, sending of arbitrary messages, or manipulation of the SMTP session. The impact depends on how the application uses MailKit/MimeKit to construct and send messages, but the advisory [2] notes that both SMTP command injection and mail header injection are possible.

Mitigation

The issue has been patched in MimeKit version 4.15.1 [2]. Users are strongly advised to upgrade to this version or later. No workarounds are mentioned in the advisory, so updating the library is the recommended course of action.