abraxas/cakephp-smtp-crlfCakePHP 5.4.2 - High - Remote - Header injection - SmtpTransport lone LF leftover of GHSA-2qh5
abraxaslabs.tech · github.com/abraxas · @abraxas_null · [email protected] · cakephp-smtp-crlf
Class: Mail header injection Reach: Remote
CakePHP 5.4.2 (887b641) - Cake Software Foundation
GHSA-2qh5 / CVE-2026-77634 added str_replace("\r\n", '', $val) on SmtpTransport and MailTransport. That callback is a no-op for a bare LF or CR. Header names are still concatenated unsanitized. PHP mail() and the SMTP DATA we captured treat a bare LF as a new header line.
If an app copies user data into a custom header, an attacker can add Bcc, rewrite Subject, or break into the body by sending LF instead of CRLF. The announced fix does not stop that. Stock cakephp/app does not put request data into custom headers by itself.
| ID | no CVE yet |
| Class | Mail header injection (lone LF leftover of GHSA-2qh5) |
| Reach | Remote (same as GHSA-2qh5: app copies user data into Message::setHeaders) |
| CWE | CWE-93 |
| CVSS | High: 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| Product | CakePHP |
| Affected | 5.4.2 (887b641de9f7aba06071f98f17edcbc573cbcf63) |
| Auth | same as GHSA-2qh5: app copies user data into Message::setHeaders / addHeaders |
| License | GNU Affero GPL v3.0 |
| Lab | 127.0.0.1 only |
Needs an application that puts request data into custom mail headers.
| Privilege | Method / sink | Lab-proven or inferred |
|---|---|---|
Inject an extra Bcc: (or Cc: / To:) line into the SMTP DATA header block | setHeaders(['X-Meta' => "ok\nBcc: [email protected]"]) then SmtpTransport::send | Lab-proven. SMTP DATA and getHeadersString both show a new Bcc: line. Witness X-Oracle: CAKEPHP-SMTP-CRLF-WITNESS |
Same injection through MailTransport | Same callback in MailTransport::send | Lab-proven on getHeadersString with the MailTransport include list and strip callback. This lab does not call PHP mail() |
| Lone CR as well as lone LF | ok\rBcc: ... | Lab-proven. Pair-only strip leaves \r; header parsers that split on CR/LF treat it as a new line |
Rewrite Subject or break into the body | Value contains \nSubject: or \n\n | Inferred from the same concatenation. Lab injected Bcc / X-Oracle, not Subject |
| Extra envelope recipient | Injected Bcc inside DATA | Inferred. Some MTAs re-parse DATA. Cake's RCPT TO still uses only setTo / setCc / setBcc on the Message object |
Two-byte \r\n pair | GHSA-2qh5 strip | Lab-proven closed. Control concatenates okBcc:... |
| Unauthenticated RCE on a skeleton app | not this leftover | Closed |
Multipart filename= CRLF | 5.4.2 already strips "/\r/\n | Closed |
I pinned cakephp/cakephp 5.4.2 after GHSA-2qh5, GHSA-fxf7, GHSA-vjqc, and the 5.4.2 filename= note. The transport tests only send "line one\r\nline two" and expect line oneline two.
SmtpTransport 5.4.2:
$headers = $message->getHeadersString(
[...],
"\r\n",
function (string $val): string {
return str_replace("\r\n", '', $val);
},
);
MailTransport uses the same callback. Message::getHeadersString maps the callback over values, then does $key . ': ' . $val.
Wrong turns already recorded: treating GHSA-2qh5 as closed and walking away; calling PHP mail() in the lab (the oracle is SMTP DATA plus getHeadersString); inflating this to unauth RCE on a skeleton app. Theatre: a reverse shell.
python3 cakephp-smtp-crlf-Abraxas-Labs.py
or
cd lab
./run.sh
Composer cakephp/cakephp:5.4.2 in PHP 8.3. Loopback SMTP sink at 127.0.0.1:19410.
X-Meta = ok\r\nBcc: [email protected]\r\nX-Oracle: CAKEPHP-SMTP-CRLF-WITNESS. Result: one header X-Meta: okBcc: [email protected]: CAKEPHP-SMTP-CRLF-WITNESS.\n only. Result: new Bcc: and X-Oracle: lines in SMTP DATA, Smtp getHeadersString, and Mail getHeadersString.\r only. Same extra lines.SUCCESS cakephp-smtp-crlf pin=5.4.2 control-crlf-stripped=yes lf-bcc=yes cr-leftover=yes how=smtp-data-bcc-line CAKEPHP-SMTP-CRLF-WITNESS
Strip or reject any \r or \n in header names and values (same as the 5.4.2 filename= sanitizer). Cover lone LF and lone CR in the transport tests, not only the \r\n pair.
887b641de9f7aba06071f98f17edcbc573cbcf63)src/Mailer/Transport/SmtpTransport.php · src/Mailer/Transport/MailTransport.php · src/Mailer/Message.phpGNU Affero GPL v3.0. See LICENSE. Loopback lab only. No warranty.