CyberRota Analysis
AI-GeneratedSuperPlane versions prior to 0.30.0 are vulnerable to an SMTP header injection flaw, enabling unauthenticated attackers to exploit CRLF sequences in webhook event payload titles. This vulnerability can lead to unauthorized manipulation of email headers, allowing attackers to add Bcc recipients for data exfiltration, forge sender addresses to evade SPF and DKIM checks, or inject malicious headers for phishing attacks. Organizations using SuperPlane should prioritize patching this vulnerability to mitigate potential email spoofing and phishing risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SuperPlane before 0.30.0 contains an SMTP header injection vulnerability that allows unauthenticated attackers to inject arbitrary SMTP headers by including CRLF sequences in the event payload title field delivered via webhook. Attackers can manipulate the unsanitized title field passed to the SMTP DATA command to add Bcc recipients for content exfiltration, forge the From address to bypass SPF and DKIM checks, or inject Content-Type and MIME boundary headers to corrupt message bodies for phishing.