Novel SMTP Smuggling Technique Slips Past DMARC, Email Protections

Attackers can spoof millions of email addresses to create targeted phishing attacks using flaws in Microsoft, GTX, and Cisco Secure Email Gateway servers.

A novel way to abuse
a decades-old protocol
used to send emails since the beginning of the Internet allows attackers to evade
Domain-based Message Authentication, Reporting and Conformance (DMARC) and other email protections
, putting organizations and individuals at risk for targeted phishing attacks that appear to come from legitimate sources.
Using a technique called SMTP smuggling, attackers can exploit Simple Mail Transfer Protocol (SMTP) on vulnerable servers to send scores of malicious emails with fake sender addresses that pass typical email security checks, security researcher Timo Longin, senior security consultant at SEC Consult, revealed
in a blog post
published Dec. 18.
The technique — which can be used with both inbound and outbound messages — exploits
zero-day flaws
in messaging servers from Microsoft, GMX, and Cisco to send spoofed emails from millions of domains to millions of receiving SMTP servers. Microsoft and GMX patched their flaws, while a potential for misconfiguration in
Cisco Secure Email
— both on-premises and cloud versions — remains unaddressed, according to the firm.
SMTP
smuggling
is a novel email spoofing technique, which allows attackers to send emails with fake sender addresses (e.g., [email protected]) to pose as someone else, Longin explains to Dark Reading. Usually, there are some mitigations in the email infrastructure to limit such attacks, but with the new approach, such a spoofed email will be delivered.
SMTP smuggling is part of the smuggling vulnerability family that exploits differing interpretations of the SMTP protocol, and is related to smuggling vulnerabilities in other protocols, such as
HTTP smuggling
.
In SMTP smuggling, attackers exploit how inbound and outbound SMTP servers interpret the end-of-data code sequence used in messaging — . — to

give SMTP a different understanding of where the message data ends, allowing an attacker to break out of the message data, specify arbitrary SMTP commands, and/or even send separate emails.
SMTP smuggling works by sending a specially crafted email through a number of (affected) email servers, Longin explains. With the right tools, this is an easy task for an attacker.
Further, this technique allows malicious emails to pass typical checks by email protection protocols DMARC, SPF, and DomainKeys Identified Mail (DKIM) by making it look like messages passed the necessary required handoff protocols built into the messaging system.
Where one server may only see one email, another server may suddenly see two emails, as the second one was hidden within the protocol, Longin explains. Email sender names and email addresses can be spoofed and security features bypassed with the identified SMTP-smuggling attack.
Since emails get smuggled/sent from the actual email server, SPF alignment checks, which are required by DMARC, let the messages pass through, Longin explains. This is the case because most email servers dont require [both] SPF and DKIM alignment, but only one of them, he says.
Enterprises are at risk from the attacks particularly because they allow threat actors to use targeted social engineering to send advanced phishing mails to employees, or create spear-phishing attacks, making the victims believe the attackers email was received from a known person, Longin says.
This is a significant threat because phishing attacks are still the primary way threat actors infiltrate organizations networks to conduct further malicious activity — including loading ransomware and other malware, he notes.
The researchers found vulnerabilities in several email services from
Microsoft
, GMX, and Cisco Secure Email Cloud Gateway that allow for SMTP smuggling and together affect millions of SMTP servers.
Microsoft Exchange Online allowed smuggling from every domain pointing their SPF record to Exchange Online, the researchers found.
This amounts to
millions of domains
 all across the globe, including some very high-value targets owned by Microsoft like microsoft.com, msn.com, github.com, outlook.com, office365.com, openai.com and many more, and also domains of their customers (e.g., tesla.com, mastercard.com, nike.com, etc.), Longin wrote in the post.
However, smuggling from Exchange Online is somewhat restricted since the receiving inbound SMTP server must support a protocol called BDAT, the researchers said.
GMX and Ionos email services allowed SMTP smuggling from roughly 1.35 million different domains, as indicated by the domains pointing their GMX record to Ionos, of which GMX is a part, the researchers found.
However, since SMTP smuggling doesnt work for every receiving inbound SMTP server and, in this case, requires inbound SMTP servers to accept . as an end-of-data sequence, the researchers conducted tests to find that only few of the bigger email providers, including Fastmail and Runbox, were affected.
The Cisco flaw, meanwhile, affects more than 40,000 vulnerable instances and allows an attacker to send spoofed emails to high-value targets, such as Amazon, PayPal, and eBay.
The researchers disclosed the bugs to all of the affected vendors, and Microsoft and GMX responded quickly to patch their systems. However, Cisco sees what the researchers consider a flaw as a feature, not a bug and against their recommendations, wont issue a warning to their customers, who need to change a vulnerable default configuration setting in order to be protected, Longin says.
Because of this, SEC Consult recommends that organizations using Cisco Secure Email Gateway (on premises) or Cisco Secure Email Cloud Gateway (cloud) to change the default settings of CR and LF Handling from Clean to Allow, citing
Cisco guidelines
to help administrators understand the change that should be made.
Regarding phishing emails in general, the researchers have advised that organizations must maintain vigilance and perform periodic awareness trainings for all employees to avoid compromise through this attack vector.
Sometimes even big software vendors use default settings with questionable security, Longin says. Regular security tests against [an organizations] own infrastructure are highly recommended to find out about the current attack surface and also detect recent vulnerabilities.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Novel SMTP Smuggling Technique Slips Past DMARC, Email Protections