Add extra tests with \r\r\n for additional Postfix vulnerability

The-Login / SMTP-Smuggling-Tools

Tools for finding SMTP smuggling vulnerabilities.

MIT License

105 stars 23 forks source link

Closed ghen2 closed 9 months ago

ghen2 commented 9 months ago

as Postfix condenses multiple CR followed by LF into a single CRLF: https://marc.info/?l=postfix-users&m=170456217431710&w=2

So this works even with patched Postfix and smtpd_forbid_bare_newline=yes.

ghen2 commented 9 months ago

Btw this is now fixed in Postfix 3.9 prerelease 20240106 (and will be in upcoming 3.5..3.8 patch releases)

The-Login commented 9 months ago

I see, I just reverted it!

ghen2 commented 9 months ago