CVE-2023-51766 SMTP Smuggling: Sneaking Forged Mail Past SPF and DMARC
CVE-2023-51766 is an SMTP smuggling flaw in Exim prior to 4.97.1, scored CVSS 5.3. The core trick is that the outbound SMTP server treats a sequence like . as ordinary body text, while the inbound SMTP server treats the same sequence as the DATA terminator. That semantic disagreement lets an attacker piggyback arbitrary MAIL FROM, RCPT TO, and BDAT commands inside what looks like one message, so a sender using a shared IP pool (GMX, Ionos, Exchange Online) can impersonate any domain hosted on those providers. SPF and DKIM still pass, and DMARC alignment succeeds, because the inbound server sees the second message as a freshly arrived, internally valid SMTP session. The fix is not more authentication; it is strict outbound filtering of terminator-like sequences, upgrading inbound Exim, and broader adoption of BDAT to retire the legacy `.` terminator.