An authenticated CRLF injection vulnerability in the Plunk email platform allows for unauthorized email header manipulation and potential sender spoofing.

This is a CRLF injection vulnerability (CWE-93) occurring in the SESService.ts module. The software fails to sanitize user-supplied input in email fields, allowing an authenticated API user to inject carriage return and line feed characters to manipulate MIME headers.

The ability to inject arbitrary headers such as Bcc or Reply-To allows attackers to conduct unauthorized email forwarding, redirect replies to external accounts, or perform sender spoofing. With a CVSS score of 8.5, this high-severity flaw threatens the integrity of communications and could be leveraged for sophisticated phishing campaigns or data exfiltration.

Immediate Action: Upgrade to Plunk version 0.8.0 or later, which implements necessary input validation at the schema level to reject CRLF characters.

Proactive Monitoring: Review API access logs for suspicious activity involving email configuration fields and monitor for unexpected email forwarding patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block CRLF sequences in API request parameters.

Public Exploit Available: Yes, a public proof-of-concept repository is available on GitHub.

Given the potential for email spoofing and unauthorized communication redirection, administrators must prioritize updating to version 0.8.0 immediately. Organizations failing to patch should restrict API access to trusted users only and implement strict input validation at the network perimeter until the software can be upgraded.