A vulnerability in MDaemon Mail Server 23.5.2 allows for email spoofing by bypassing SPF, DKIM, and DMARC checks via crafted Unicode characters.

The application incorrectly validates email sender headers by using Unicode thin spaces to deceive verification mechanisms. The attack requires low privileges and can be performed remotely by an authenticated user.

This vulnerability facilitates sophisticated phishing and business email compromise (BEC) attacks by allowing unauthorized parties to masquerade as trusted internal or external senders. With a CVSS score of 7.1, the high impact on integrity poses a significant risk to organizational communication security and brand reputation, as security controls like DMARC are rendered ineffective against these specific messages.

Immediate Action: Utilize the Header Screening feature within MDaemon to filter out malicious headers as recommended by the vendor.

Proactive Monitoring: Review mail server logs for anomalous header patterns and implement strict sender identity verification at the email gateway level.

Compensating Controls: Deploy client-side email security plugins that perform independent validation of sender identities and flag suspicious inconsistencies.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced GitHub repository.

Given the potential for this flaw to facilitate large-scale phishing campaigns, administrators must prioritize the implementation of the suggested Header Screening feature. While the vendor disputes the nature of this flaw by classifying it as a client-side issue, the risk to the mail environment is tangible and warrants immediate hardening of mail server configuration policies.