CVE-2023-51766: 
Exim vulnerability analysis and mitigation

CVE-2023-51766 affects Exim before version 4.97.1, allowing SMTP smuggling in certain PIPELINING/CHUNKING configurations. The vulnerability was discovered in December 2023 and enables remote attackers to inject email messages with spoofed MAIL FROM addresses, bypassing SPF protection mechanisms. This occurs because Exim supports certain line ending sequences that some other popular email servers do not (NVD, SEC Consult).

The vulnerability requires specific conditions to be exploited: Exim must offer both PIPELINING and CHUNKING on incoming connections, and DATA (rather than BDAT) must be used for message reception. The attack leverages differences in how servers interpret line endings like 'LF . LF', 'CR LF . LF', or 'LF . CR LF'. When these conditions are met, attackers can inject additional SMTP commands as part of message data, leading to message smuggling (Exim Bug, SEC Consult). The vulnerability has been assigned a CVSS v3.1 base score of 5.3 (Medium) (NVD).

The vulnerability allows attackers to bypass SPF protection mechanisms and inject unauthorized email messages. When successfully exploited, attackers can send messages that appear to originate from legitimate domains, potentially enabling sophisticated phishing attacks. Messages accepted through this vulnerability bypass proper validation by the relay server (SEC Consult).

The primary fix is to upgrade to Exim version 4.97.1 or later. For those unable to upgrade immediately, two workarounds are available: either disable CHUNKING advertisement for incoming connections (which will cause DATA command smuggling attempts to fail synchronization checks) or disable PIPELINING advertisement (which will cause smuggled MAIL FROM commands to fail synchronization checks) (Exim Bug).

The vulnerability disclosure process faced some criticism from the open-source community due to lack of coordination with affected projects. While some vendors like GMX and Microsoft quickly addressed the issue, others like Cisco initially classified it as a feature rather than a vulnerability. The disclosure timing just before the end-of-year holidays created additional challenges for administrators and projects (LWN).