I'm trying to understand SMTP header injection. I'm using Python's SMTPLIB library to proto-type this vulnerability. Here is my code:
import smtplib # create variables server = 'smtp.zoho.com' port = 587 to = 'firstname.lastname@example.org' user = 'email@example.com' passwd = 'pwd' smtpserver = smtplib.SMTP(server, port) def mail(): smtpserver.ehlo() smtpserver.starttls() smtpserver.ehlo smtpserver.login(user, passwd) header = 'To:' + to + '\n' + 'From: ' + user + '\ncc:firstname.lastname@example.org\n' + 'Subject:testing \n' msg = header + '\n test 5 \n\n' smtpserver.sendmail(user, to, msg) print header + 'done!' smtpserver.close() # call mail method mail()
I've tried using the Zoho and Gmail SMTP server. The email is successfully sent to the address in the "to" variable, but it is not sent to the "email@example.com" email address. When I view the message in Gmail or Zoho I do see the "firstname.lastname@example.org" in the CC field, but it never gets sent to the second email address. I've also tried to inject the Subject field with the same results.
Can someone explain this to me? Is this some filtering done on Gmail/Zoho's end?