Lyin-OTTF opened a new pull request, #414:
URL: https://github.com/apache/commons-net/pull/414
`IMAP.sendCommandWithID()` concatenates the command ID, command and
arguments into one control line terminated by CRLF, without checking the
inputs. `FTP.sendCommand()`, `POP3.sendCommand()`, `NNTP.sendCommand()` and
`SMTP.sendCommand()` all reject CR or LF for exactly this reason, so on IMAP a
call like
```java
imap.select("INBOX\r\nA001 DELETE INBOX");
```
writes two lines to the control connection and executes an attacker-chosen
second command. Mailbox names are one realistic carrier (they regularly come
from user configuration), and `IMAP.quoteMailboxName()` already rejects CR/LF -
but that only covers arguments routed through it, while `LOGIN` credentials
(via `AuthenticatingIMAPClient.login`) and any direct `sendCommand()` call
bypass it.
The command layer is the last line of defense and was the only one of the
five protocols missing the guard. The check mirrors the wording and placement
of the POP3/NNTP/SMTP guards.
`IMAPTest` gains four cases covering CR, LF and CRLF in the argument and
CR/CRLF in the command name. On an unconnected client they fail with
`NullPointerException` before this change and throw `IllegalArgumentException`
with it.
Verification: Windows, JDK 21. `mvn test -Dtest=IMAPTest` passes (19/19 with
the fix); reverting only `IMAP.java` fails exactly the four new cases.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
