I'm trying to understand SMTP header injection. I'm using Python's SMTPLIB library to proto-type this vulnerability. Here is my code:
import smtplib
# create variables
server = 'smtp.zoho.com'
port = 587
to = '[email protected]'
user = '[email protected]'
passwd = 'pwd'
smtpserver = smtplib.SMTP(server, port)
def mail():
smtpserver.ehlo()
smtpserver.starttls()
smtpserver.ehlo
smtpserver.login(user, passwd)
header = 'To:' + to + '\n' + 'From: ' + user + '\ncc:[email protected]\n' + 'Subject:testing \n'
msg = header + '\n test 5 \n\n'
smtpserver.sendmail(user, to, msg)
print header + 'done!'
smtpserver.close()
# call mail method
mail()
I've tried using the Zoho and Gmail SMTP server. The email is successfully sent to the address in the "to" variable, but it is not sent to the "[email protected]" email address. When I view the message in Gmail or Zoho I do see the "[email protected]" in the CC field, but it never gets sent to the second email address. I've also tried to inject the Subject field with the same results.
Can someone explain this to me? Is this some filtering done on Gmail/Zoho's end?
Thanks, Johnny_v