邮件安全 on 思安录 | Thinking's Security Notes https://blog.1sec.day/tags/%E9%82%AE%E4%BB%B6%E5%AE%89%E5%85%A8/ Recent content in 邮件安全 on 思安录 | Thinking's Security Notes Hugo -- gohugo.io zh-cn Thinking Thinking Fri, 15 Dec 2023 00:00:00 +0000 CVE-2023-51766 SMTP Smuggling：把伪造邮件偷渡过 SPF 与 DMARC https://blog.1sec.day/posts/2023-12-15-cve-2023-51766-smtp-smuggling/ Fri, 15 Dec 2023 00:00:00 +0000 Thinking https://blog.1sec.day/posts/2023-12-15-cve-2023-51766-smtp-smuggling/ <p>出站 SMTP 把 <code>&lt;LF&gt;.&lt;CR&gt;&lt;LF&gt;</code> 当成普通正文放行，入站 SMTP 却把它当作 DATA 结束符——这一对解释差异让攻击者能把任意 SMTP 命令偷渡进收件方，绕过 SPF/DKIM/DMARC，伪造 gmx.net、web.de、Exchange Online 等域名发信。</p>