CVE-2021-38189: SMTP Command Injection in lettre
Summary
CVE-2021-38189: SMTP command injection in lettre. Affects lettre versions >= 0.7.0, < 0.9.6. Fixed in 0.9.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
lettre is a crate for sending emails in Rust. It provides a high-level interface for composing and sending emails via various transport methods, including SMTP. The vulnerability in lettre allows for SMTP command injection through an attacker's controlled message body. This occurs because the module for escaping lines starting with a period fails to catch a period placed after a double CRLF sequence. As a result, an attacker can end the current message and inject arbitrary SMTP commands.
Vulnerability Detail
The SMTP command injection vulnerability in lettre has a critical impact. By exploiting this vulnerability, an attacker can manipulate the message body to inject malicious SMTP commands. This can lead to various consequences, such as unauthorized access, data exfiltration, or remote code execution on the target system. The flaw is fixed by correctly handling consecutive CRLF sequences.
How To Fix
Minimum fixed version
0.9.6
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update lettre to the fixed version to mitigate the risk of SMTP command injection.
Conclusion
The SMTP command injection vulnerability in lettre can have severe consequences, including unauthorized access and remote code execution. It is crucial to update lettre to version 0.9.6 or later to mitigate this risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for lettre →
FAQ
lettre is a Rust crate for sending emails. It provides a high-level interface for composing and sending emails via various transport methods, including SMTP.
SMTP command injection is a vulnerability that allows an attacker to inject arbitrary SMTP commands into an email message. In the case of lettre, the vulnerability allows an attacker to manipulate the message body and inject malicious SMTP commands.
Exploiting this vulnerability can lead to unauthorized access, data exfiltration, or remote code execution on the target system. It is crucial to update lettre to the fixed version to mitigate these risks.
To fix this vulnerability, update lettre to version 0.9.6 or later. Make sure to review your code and dependencies to ensure they are using the fixed version.
No, there is no known workaround for this vulnerability. Updating lettre to the fixed version is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for lettre.
