https://blog.1sec.day/en-gb/tags/email-security/ Recent content in Email Security on 思安录 | Thinking's Security Notes Hugo -- gohugo.io en-gb Thinking Thinking Fri, 15 Dec 2023 00:00:00 +0000 https://blog.1sec.day/en-gb/posts/2023-12-15-cve-2023-51766-smtp-smuggling/ Fri, 15 Dec 2023 00:00:00 +0000 Thinking https://blog.1sec.day/en-gb/posts/2023-12-15-cve-2023-51766-smtp-smuggling/ <p>The outbound SMTP server treats <code>&lt;LF&gt;.&lt;CR&gt;&lt;LF&gt;</code> as ordinary body content; the inbound server treats it as the DATA terminator. That interpretation gap lets an attacker smuggle arbitrary SMTP commands past the recipient, bypassing SPF/DKIM/DMARC and forging mail from gmx.net, web.de, Exchange Online and beyond.</p>