CVE-2024-27305

aiosmtpd is vulnerable to SMTP smuggling, allowing spoofed emails.

• CVSS 5.3
• CWE-345
• Input Validation and Sanitization
• Remote

aiosmtpd is a reimplementation of the Python stdlib smtpd.py based on asyncio. aiosmtpd is vulnerable to inbound SMTP smuggling. SMTP smuggling is a novel vulnerability based on not so novel interpretation differences of the SMTP protocol. By exploiting SMTP smuggling, an attacker may send smuggle/spoof e-mails with fake sender addresses, allowing advanced phishing attacks. This issue is also existed in other SMTP software like Postfix. With the right SMTP server constellation, an attacker can send spoofed e-mails to inbound/receiving aiosmtpd instances. This issue has been addressed in version 1.4.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVE

CVE-2024-27305

CWE

CWE-345

CVSS base score

5.3

Published

2024-03-12

OWASP

A05 Security Misconfiguration

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Data Theft

Affected component

aiosmtpd

Fixed by upgrading

Yes

Solution

Upgrade to aiosmtpd version 1.4.5 or later.

import asyncio
from aiosmtpd.controller import Controller
from aiosmtpd.smtp import SMTP

class CustomSMTP(SMTP):
    async def handle_DATA(self, server, session, envelope):
        print(f"Received email from: {envelope.mail_from}")
        return '250 OK'

async def main():
    controller = Controller(CustomSMTP, port=1025)
    controller.start()
    await asyncio.Event().wait()

if __name__ == "__main__":
    asyncio.run(main())

import asyncio
import ssl
from aiosmtpd.controller import Controller
from aiosmtpd.smtp import SMTP

class CustomSMTP(SMTP):
    async def handle_DATA(self, server, session, envelope):
        if not self.is_valid_sender(envelope.mail_from):
            return '550 Invalid sender address'
        return await super().handle_DATA(server, session, envelope)

    def is_valid_sender(self, sender):
        allowed_domains = {"example.com", "safe.org"}
        if sender and "@" in sender:
            domain = sender.split('@')[1].lower()
            return domain in allowed_domains
        return False

async def main():
    ssl_context = ssl.create_default_context(ssl.Purpose.CLIENT_AUTH)
    ssl_context.load_cert_chain('cert.pem', 'key.pem')

    controller = Controller(CustomSMTP, port=1025, ssl_context=ssl_context, require_starttls=True)
    controller.start()
    await asyncio.Event().wait()

if __name__ == "__main__":
    asyncio.run(main())

MAIL FROM:<attacker@example.com>
RCPT TO:<victim@example.com>
DATA
Subject: Important Update

This is a phishing email pretending to be from a trusted source.
.

@misc{vaitp:cve202427305,
  title        = {{aiosmtpd is vulnerable to SMTP smuggling, allowing spoofed emails.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-27305},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-27305/}}
}