I have an application where a code scanner has identified CRLF injection possibilities in some classes related to email generation.

I understand how CRLF injection could be used against me on URL-based attacks, but google has been kinda silent on threats coming from email. Are we concerned with injecting different addresses in SMTP conversations like this:



Or something else?

  • Do you have a specific reference id from your code scanner?
    – Eric G
    Commented Mar 25, 2014 at 15:57
  • Multiple hits. And I'm security-minded, I'm just trying to decide what the threat basis is in the first place. I can't see how I'd want to exploit this for nefarious ends.
    – avgvstvs
    Commented Mar 25, 2014 at 16:04

2 Answers 2


Depending on how your application creates the actual RAW email request, it may be possible to insert line feeds to modify the recipients, CC, BCC etc.

Check out this example:

In this context, the target is to be able to send anonymous emails to other recipients. There are numerous additional fields that can be specified in the mail headers (see [ RFC 822 ]). For example 'Cc' (Carbon Copy), which sends a copy of the message to the email addresses given as arguments. A better choice is to use the 'Bcc' (Blind Carbon Copy) which sends a carbon copy of the message just like with the 'Cc' header, except that the recipiends email addresses given as arguments are not shown to the multiple recipients' headers. As specified in the [ RFC 822 ], one must add a line feed for every header. The (line feed) char has a hexadecimal value of 0x0A.

  Sender: "[email protected]%0ACc:[email protected]%0ABcc:[email protected],[email protected]"

  Subject: ahem
  Message: "My Message"

will result in

 To: [email protected] 
 Subject: ahem
 From: [email protected]
 Cc:[email protected]
 Bcc:[email protected],[email protected]

 My Message...

Also, check out some OWASP Guidance, and some examples under CWE-93.


Here is an example of a PHP mail-generating script that is vulnerable to a CRLF-injection attack. In essence, the problematic code was:

$headers="From: {$email}\r\nReply-To: {$email}"; //create headers
mail('[email protected]',$subject,$content,$headers); //mails it

In that case, a poorly designed PHP API was difficult to use correctly. As a result, a web-based contact form could be used to send arbitrary spam, if an attacker made a POST request whose email parameter ended with a CRLFCC: [email protected].

I invite you to submit your code to Code Review, where we can go over all aspects of your code, including potential security issues such as CRLF injection.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .