New to CAPEC? Start Here
Home > CAPEC List > CAPEC-183: IMAP/SMTP Command Injection (Version 3.7)  

CAPEC-183: IMAP/SMTP Command Injection

Attack Pattern ID: 183
Abstraction: Standard
Status: Draft
Presentation Filter:
+ Description
An adversary exploits weaknesses in input validation on web-mail servers to execute commands on the IMAP/SMTP server. Web-mail servers often sit between the Internet and the IMAP or SMTP mail server. User requests are received by the web-mail servers which then query the back-end mail server for the requested information and return this response to the user. In an IMAP/SMTP command injection attack, mail-server commands are embedded in parts of the request sent to the web-mail server. If the web-mail server fails to adequately sanitize these requests, these commands are then sent to the back-end mail server when it is queried by the web-mail server, where the commands are then executed. This attack can be especially dangerous since administrators may assume that the back-end server is protected against direct Internet access and therefore may not secure it adequately against the execution of malicious commands.
+ Typical Severity

Medium

+ Relationships
Section HelpThis table shows the other attack patterns and high level categories that are related to this attack pattern. These relationships are defined as ChildOf and ParentOf, and give insight to similar items that may exist at higher and lower levels of abstraction. In addition, relationships such as CanFollow, PeerOf, and CanAlsoBe are defined to show similar attack patterns that the user may want to explore.
NatureTypeIDName
ChildOfMeta Attack PatternMeta Attack Pattern - A meta level attack pattern in CAPEC is a decidedly abstract characterization of a specific methodology or technique used in an attack. A meta attack pattern is often void of a specific technology or implementation and is meant to provide an understanding of a high level approach. A meta level attack pattern is a generalization of related group of standard level attack patterns. Meta level attack patterns are particularly useful for architecture and design level threat modeling exercises.248Command Injection
Section HelpThis table shows the views that this attack pattern belongs to and top level categories within that view.
+ Execution Flow
Explore
  1. Identify Target Web-Mail Server: The adversary first identifies the web-mail server they wish to exploit.

Experiment
  1. Identify Vulnerable Parameters: Once the adversary has identified a web-mail server, they identify any vulnerable parameters by altering their values in requests. The adversary knows that the parameter is vulnerable if the web-mail server returns an error of any sort. Ideally, the adversary is looking for a descriptive error message.

    Techniques
    Assign a null value to a parameter being used by the web-mail server and observe the response.
    Assign a random value to a parameter being used by the web-mail server and observe the response.
    Add additional values to a parameter being used by the web-mail server and observe the response.
    Add non standard special characters (i.e.: \, ', ", @, #, !, |) to a parameter being used by the web-mail server and observe the response.
    Eliminate a parameter being used by the web-mail server and observe the response.
  2. Determine Level of Injection: After identifying all vulnerable parameters, the adversary determines what level of injection is possible.

    Techniques
    Evaluate error messages to determine what IMAP/SMTP command is being executed for the vulnerable parameter. Sometimes the actually query will be placed in the error message.
    If there aren't descriptive error messages, the adversary will analyze the affected functionality to deduce the possible commands that could be being used by the mail-server.
Exploit
  1. Inject IMAP/SMTP Commands: The adversary manipulates the vulnerable parameters to inject an IMAP/SMTP command and execute it on the mail-server.

    Techniques
    Structure the injection as a header, body, and footer. The header contains the ending of the expected message, the body contains the injection of the new command, and the footer contains the beginning of the expected command.
    Each part of the injection payload needs to be terminated with the CRLF (%0d%0a) sequence.
+ Prerequisites
The target environment must consist of a web-mail server that the attacker can query and a back-end mail server. The back-end mail server need not be directly accessible to the attacker.
The web-mail server must fail to adequately sanitize fields received from users and passed on to the back-end mail server.
The back-end mail server must not be adequately secured against receiving malicious commands from the web-mail server.
+ Resources Required
None: No specialized resources are required to execute this type of attack. However, in most cases, the attacker will need to be a recognized user of the web-mail server.
+ References
[REF-49] "OWASP Web Security Testing Guide". Testing for IMAP SMTP Injection. The Open Web Application Security Project (OWASP). <https://www.owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/10-Testing_for_IMAP_SMTP_Injection>.
+ Content History
Submissions
Submission DateSubmitterOrganization
2014-06-23CAPEC Content TeamThe MITRE Corporation
Modifications
Modification DateModifierOrganization
2017-08-04CAPEC Content TeamThe MITRE Corporation
Updated Resources_Required
2019-04-04CAPEC Content TeamThe MITRE Corporation
Updated Related_Weaknesses
2020-12-17CAPEC Content TeamThe MITRE Corporation
Updated References
2022-02-22CAPEC Content TeamThe MITRE Corporation
Updated Description, Execution_Flow
More information is available — Please select a different filter.
Page Last Updated or Reviewed: October 21, 2021