CRLF Header Injection in zbateson Mail-Mime-Parser

Executive Summary

This vulnerability is a CRLF header injection flaw in zbateson mail-mime-parser versions before 3.0.9 and 4.x before 4.0.6. Attackers can inject malicious header lines like forged Bcc fields into outgoing messages by supplying crafted MIME type, charset, encoding, micalg, or protocol values containing CR or LF characters.

Useful 0 Not Useful 0

Impact Analysis

An attacker could forge email headers such as adding unauthorized recipients via Bcc, override existing headers like Content-Disposition, or manipulate message structure. This could lead to email spoofing, unauthorized data access, or phishing attacks if exploited through untrusted inputs like browser uploads.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data exposure or manipulation of email content, potentially violating GDPR's data protection requirements or HIPAA's confidentiality rules if sensitive information is involved. Organizations using affected versions may face compliance risks due to potential data breaches.

Useful 0 Not Useful 0

Mitigation Strategies

Update the zbateson mail-mime-parser library to version 3.0.9 or later for the 3.x branch, or to version 4.0.6 or later for the 4.x branch. If updating is not immediately possible, ensure all inputs passed to message-building helpers are sanitized to remove CR and LF characters before processing.

Useful 0 Not Useful 0