SMTP smuggling
An email spoofing attack published by SEC Consult in December 2023 that hides a second message inside the first by exploiting servers that disagree about where message data ends.
What it means
The standard end of message data is CRLF.CRLF, but some servers also accepted variants built on bare line feeds, such as LF.LF or LF.CRLF. An attacker who could send through an outbound service that passed such a sequence through unchanged could place a fake end-of-data marker in the middle of a message, followed by new SMTP commands. A receiving server that honoured the variant would then see two messages, the second one spoofing a sender of the attacker's choosing while arriving from the legitimate service's servers, so SPF could pass for it.
Postfix's maintainer traced the weakness to Sendmail's decades-old acceptance of bare line feeds, which Postfix and Exim had copied for compatibility, and Postfix added settings to reject them. Strict handling of line endings is a security matter for mail servers.
Related terms
Sources
What this definition rests on. The wording is ours; the facts are theirs.
- SEC Consult: SMTP Smuggling, spoofing e-mails worldwidesec-consult.com
- Postfix: SMTP Smugglingpostfix.org
All 432 terms in the glossaryThe wiki: blocklists and bounce codes