CVE-2023-51764: 
Postfix vulnerability analysis and mitigation

CVE-2023-51764 affects Postfix through version 3.8.5, allowing SMTP smuggling attacks unless properly configured. The vulnerability was discovered by Timo Longin of SEC Consult in June 2023 and publicly disclosed on December 18, 2023. The flaw enables remote attackers to inject email messages with spoofed MAIL FROM addresses, bypassing SPF protection mechanisms. This occurs because Postfix supports certain non-standard line endings that some other email servers interpret differently (SEC Consult Blog, Postfix Advisory).

The vulnerability exploits differences in how email servers handle SMTP end-of-data sequences. The attack involves a composition of two email services with different interpretations of non-standard line endings (like '\n.\n' instead of '\r\n.\r\n'). An attacker can use this discrepancy to break out of the message data section and inject additional SMTP commands, effectively smuggling new email messages. The vulnerability has a CVSS 3.1 base score of 5.3 (MEDIUM) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N (NVD).

The vulnerability allows authenticated attackers to spoof email messages that appear to originate from any domain hosted on the vulnerable outbound email service to any recipient on vulnerable inbound servers. These spoofed emails can bypass SPF-based DMARC checks because they are sent through legitimate mail servers. This makes the attack particularly effective for phishing campaigns as the emails appear legitimate and pass standard security checks (Postfix Advisory, SEC Consult Blog).

Postfix has released several mitigations. The recommended configuration includes setting 'smtpdforbidbarenewline = normalize' and 'smtpdforbidbarenewlineexclusions = $mynetworks'. For older versions, workarounds include setting 'smtpddatarestrictions=rejectunauthpipelining' and 'smtpddiscardehlokeywords=chunking'. The vulnerability is fixed in Postfix versions 3.5.23, 3.6.13, 3.7.9, 3.8.4, and later releases. Version 3.9 will have these protections enabled by default (Postfix Advisory, Postfix Announcement).