Security Research

CVE-2023-51766 SMTP Smuggling Recap: Where Exim's End-of-Data Interpretation Breaks

Thinking 2024-02-15 6 min read Research Dossier
#Vulnerability Analysis#Code Audit#Network Attack
Dark dossier of SMTP end-of-data sequence and smuggling path

Exim before 4.97.1 delegates the decision of “when DATA ends” to whatever bytes the SMTP client carries — effectively outsourcing the trust boundary to the peer. As long as the outbound passes <LF>.<CR><LF> and the inbound accepts it as the end marker, attackers can smuggle arbitrary SMTP commands into the same session.

Unlock to view this content.