CVE-2024-27305: SMTP smuggling in aiosmtpd
Summary aiosmtpd is vulnerable to inbound SMTP smuggling. SMTP smuggling is a novel vulnerability based on not so novel interpretation differences of the SMTP protocol. By exploiting SMTP smuggling, an attacker may send smuggle/spoof e-mails with fake sender addresses, allowing advanced phishing attacks. This issue also existed in other SMTP software like Postfix (https://www.postfix.org/smtp-smuggling.html).
Details Detailed information on SMTP smuggling can be found in the full blog post (https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/) or on the Postfix homepage (https://www.postfix.org/smtp-smuggling.html). (and soon on the official website https://smtpsmuggling.com/)
Impact With the right SMTP server constellation, an attacker can send spoofed e-mails to inbound/receiving aiosmtpd instances.
Other sources
aiosmtpd is a reimplementation of the Python stdlib smtpd.py based on asyncio. aiosmtpd is vulnerable to inbound SMTP smuggling. SMTP smuggling is a novel vulnerability based on not so novel interpretation differences of the SMTP protocol. By exploiting SMTP smuggling, an attacker may send smuggle/spoof e-mails with fake sender addresses, allowing advanced phishing attacks. This issue is also existed in other SMTP software like Postfix. With the right SMTP server constellation, an attacker can send spoofed e-mails to inbound/receiving aiosmtpd instances. This issue has been addressed in version 1.4.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-27305?
CVE-2024-27305 has a medium severity rating due to its potential to allow spoofed email addresses.
How do I fix CVE-2024-27305?
To fix CVE-2024-27305, upgrade aiosmtpd to version 1.4.5 or later.
What kind of attacks can CVE-2024-27305 enable?
CVE-2024-27305 can enable attackers to send smuggled emails with false sender addresses.
Which versions of aiosmtpd are affected by CVE-2024-27305?
CVE-2024-27305 affects all versions of aiosmtpd prior to 1.4.5.
Is CVE-2024-27305 a widespread vulnerability?
The impact of CVE-2024-27305 is limited to users of aiosmtpd who have not yet updated to the secure version.