CVE-2024-6923

Email module in CPython allows header injection due to improper newline quoting.

• CVSS 5.5
• CWE-94
• Input Validation and Sanitization
• Remote

There is a MEDIUM severity vulnerability affecting CPython. The email module didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized.

CVE

CVE-2024-6923

CWE

CWE-94

CVSS base score

5.5

Published

2024-08-01

OWASP

A03 Injection

Orthogonal defect classification

Checking

Code defect classification

Incorrect Check

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Information Disclosure

Affected component

email module

Fixed by upgrading

Yes

Solution

Upgrade to CPython version 3.10.5 or later, where this issue is addressed.

import email
from email.message import EmailMessage

msg = EmailMessage()
msg['Subject'] = 'Test Email'
msg['From'] = 'sender@example.com'
msg['To'] = 'recipient@example.com'

msg['X-Custom-Header'] = 'Value with newline\nInjected Header: value'

serialized_msg = msg.as_string()

print(serialized_msg)

import email
from email.message import EmailMessage
import re

def sanitize_email_headers(msg):
    for header, value in msg.items():
        if '\n' in value or '\r' in value:
            msg[header] = re.sub(r'[\r\n]', '', value)
    return msg

msg = EmailMessage()
msg['Subject'] = 'Test Email'
msg['From'] = 'sender@example.com'
msg['To'] = 'recipient@example.com'
msg['X-Custom-Header'] = 'Value with newline\nInjected Header: value'

msg = sanitize_email_headers(msg)

serialized_msg = msg.as_string()

print(serialized_msg)

'Injected-Header: malicious_value\n'

@misc{vaitp:cve20246923,
  title        = {{Email module in CPython allows header injection due to improper newline quoting.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-6923},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-6923/}}
}