# SMTP Command Injection in Appointment Emails via Newlines

Unsantized newlines in the appointment booking email field let an attacker inject SMTP commands into the authenticated mail session, leaking server info and enabling mail hijack.

- Payout: hidden
- Severity: medium
- Program: Nextcloud
- Found by: spaceraccoon
- Disclosed: 2022-12-27
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/1509216
- Library page: https://bugbountylibrary.com/r/h1%3A1509216
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:email technique:source-review vuln:command-injection vuln:crlf-injection

**Target:** POST /apps/calendar/appointment/{id}/book email parameter
**Root cause:** The booking email value is passed unsanitized into SwiftMailer's RCPT TO command; newlines break out of the SMTP command context, and a crafted payload passes both PHP email validation and SwiftMail injection.
**Steps:**
1. Create an appointment calendar in Nextcloud Calendar.
2. As another user, open the booking link and submit a booking.
3. Intercept the POST /apps/calendar/appointment/1/book request.
4. Set `email` to `">\r\nEHLO a\r\nRCPT TO:<a@a.com>"@b.com`.
5. Observe the SMTP server banner leaked in the JSON error response.
**How found:** Researcher noticed the email value flows into the SMTP RCPT TO command and tested newline injection, then crafted a payload satisfying both PHP email validation and SwiftMail parsing.
**Exploitation:** Attacker injects CRLF sequences into the email field to terminate the RCPT TO command and append arbitrary SMTP commands (e.g. EHLO, MAIL FROM, RCPT TO) executed within the already-authenticated SMTP session, with server responses reflected in the HTTP error.
**Escalation:** Impact scales with backend SMTP capabilities: changing MAIL FROM, sending mail to arbitrary recipients, or other server-supported commands.
**Insight:** When a user-controlled field lands in an SMTP envelope command, try payloads that satisfy the app's email validator while still breaking out of the angle-bracket RCPT TO context, and use reflected SMTP error responses as a non-blind oracle.