# SMTP Injection in Gsuite

G Suite admin custom-subject setting accepted CRLF, injecting SMTP headers so emails appeared to originate from arbitrary @google.com addresses.

- Payout: $3,134
- Severity: medium
- Program: Google
- Credited: Zohar Shachar
- Disclosed: 2020-06-15
- Write-up quality: 7/10
- Original: https://www.ehpus.com/post/smtp-injection-in-gsuite
- Library page: https://bugbountylibrary.com/r/blog%3Aehpus-com-post-smtp-injection-in-gsuite
- Tags: domain:web impact:integrity kind:bounty platform:blog sev:medium tech:email technique:source-review vuln:crlf-injection

**Target:** Gmail advanced routing settings (custom subject header)
**Root cause:** The admin-configured 'custom subject' value was inserted into the SMTP DATA headers without stripping CRLF, letting an attacker break out of the Subject header and inject arbitrary headers like From.
**Steps:**
1. Log into admin.google.com, go to Apps -> G Suite -> Gmail -> Advanced settings -> Routing.
2. Add a routing setting with a 'custom subject' value.
3. Intercept the save request and inject `\r\n` into the subject value, e.g. `test\r\nFrom: admin@google.com`.
4. Send a test email to the account and observe the injected From header rendered in Gmail.
**How found:** Noted custom headers are prefixed with X- preventing full control, tried newline injection in header name (blocked), then pivoted to the adjacent 'custom subject' field since Subject is itself just a DATA header, and tested CRLF there via proxy.
**Exploitation:** An admin (or anyone able to set the routing custom subject) injects CRLF plus a `From:` header into the subject; outbound/inbound mail then carries a spoofed From of any @google.com address, bypassing DNS-based sender validation since mail originates from Google's own servers.
**Insight:** When a header-name field is hardened against CRLF, check sibling fields (subject, display name, reply-to) that also land in the SMTP DATA block — they often lack the same filtering.