# SMTP Command Injection in iCalendar Attachments to Emails via Newlines

Unsanitized newlines in iCalendar ORGANIZER email let an attacker inject SMTP commands into Nextcloud Calendar's pipelined mail session, hijacking the authenticated SMTP connection.

- Payout: hidden
- Severity: medium
- Program: Nextcloud
- Found by: spaceraccoon
- Disclosed: 2022-07-04
- CVE: CVE-2022-31014
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/1516377
- Library page: https://bugbountylibrary.com/r/h1%3A1516377
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:email technique:source-review vuln:command-injection vuln:crlf-injection

**Target:** iCalendar import / SMTP mail transport (SwiftMailer)
**Root cause:** The ORGANIZER mailto address from an imported iCalendar event is passed unsanitized into pipelined SMTP commands, so embedded newlines split into attacker-controlled SMTP commands.
**Steps:**
1. Configure email sending in Nextcloud admin settings; enable SMTP command logging in SwiftMailer AbstractSmtpTransport.php.
2. Send victim a .ics attachment whose ORGANIZER property contains `mailto:test(\nEHLO a\n)@gmail.com`.
3. As victim, open Mail, click event.ics > Import into Calendar > Personal to trigger the PUT to /remote.php/dav/calendars/...
4. Observe injected `EHLO a` command in the SMTP log and the SMTP server's 250 response echoed in the JSON error.
**How found:** Noticed the ORGANIZER email is used in the pipelined SMTP reply and hypothesized newlines in the property would inject commands; confirmed by adding logging to SwiftMailer's AbstractSmtpTransport.
**Exploitation:** Attacker emails a poisoned .ics; when the victim imports it, Nextcloud sends an attendee-reply email to the ORGANIZER address, and the injected newlines break out of the pipelined SMTP command stream, letting the attacker run arbitrary SMTP commands within the already-authenticated session (e.g. change MAIL FROM, send mail as the user). Errors are reflected in the HTTP response, making it non-blind.
**Escalation:** Impact scales with backend SMTP capabilities; can pivot to sending emails as the authenticated user or altering envelope sender.
**Insight:** When an app pipelines SMTP commands, any user-controlled field (like iCalendar ORGANIZER/ATTENDEE mailto) that lands in the command stream is a CRLF injection sink; test by embedding `\n` in mailto addresses and watching for reflected SMTP responses.