Email header injection
An attack on a web form or app that builds email from user input: injected line breaks add headers such as Bcc, turning the form into a spam relay.
What it means
Message headers are separated by line breaks. If an application places user input, such as a name, email address or subject, into a header without removing carriage returns and line feeds, an attacker can end the header early and add new ones: extra recipients through Cc or Bcc, a different From, or a new body. MITRE catalogues it as CAPEC-134, email injection.
The result is mail sent from your server and domain, signed and authenticated as yours, to whomever the attacker chooses. That damages domain and IP reputation and can get the server blocklisted.
Prevent it by rejecting or stripping CR and LF in any value used in a header, validating email addresses strictly, and using mail libraries that encode headers rather than concatenating strings.
Example
name=Alice%0d%0aBcc:%20victims@example.netRelated terms
Sources
What this definition rests on. The wording is ours; the facts are theirs.
- MITRE CAPEC-134: Email Injectioncapec.mitre.org
All 432 terms in the glossaryThe wiki: blocklists and bounce codes