SMTP Header Injection in SuperPlane via Webhook Payload

Executive Summary

This vulnerability is an SMTP header injection flaw in SuperPlane versions before 0.30.0. Attackers can exploit CRLF sequences in the webhook event payload title field to inject arbitrary SMTP headers. This allows manipulation of unsanitized title fields passed to the SMTP DATA command, enabling actions like adding Bcc recipients for data exfiltration, forging From addresses to bypass SPF and DKIM checks, or corrupting message bodies for phishing.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for SMTP traffic anomalies such as unexpected Bcc recipients, forged From addresses, or corrupted message bodies. Check webhook event payloads for CRLF sequences in title fields. Inspect SuperPlane logs for unsanitized SMTP header injections.

Useful 0 Not Useful 0

Impact Analysis

Unauthenticated attackers could exfiltrate sensitive data via Bcc recipients, bypass email security checks by forging sender addresses, or corrupt email content to deliver phishing messages. This could lead to data breaches, unauthorized access to information, or increased risk of successful phishing attacks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data exfiltration or access, violating GDPR's data protection principles and HIPAA's requirements for safeguarding protected health information. Organizations using vulnerable versions may face compliance violations, legal penalties, and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade SuperPlane to version 0.30.0 or later to address the SMTP header injection flaw. Ensure SMTP header sanitization is enforced in webhook event processing. Review and validate organization scoping for all canvas-related operations.

Useful 0 Not Useful 0