Improper Neutralization of Special Elements used in a Command

ID

scala.smtp.scala_smtp_rule_smtpclient

Severity

high

Remediation Complexity

medium

Remediation Risk

medium

Remediation Effort

medium

Resource

Smtp

Language

Scala

Description

Simple Mail Transfer Protocol (SMTP) is a the text based protocol used for email delivery. Like with HTTP, headers are separate by new line separator. If kuser input is place in a header line, the application should remove or replace new line characters (CR / LF). You should use a safe wrapper such as Apache Common Email and Simple Java Mail which filter special characters that can lead to header injection.

Rationale

Simple Mail Transfer Protocol (SMTP) is a the text based protocol used for email delivery. Like with HTTP, headers are separate by new line separator. If kuser input is place in a header line, the application should remove or replace new line characters (CR / LF). You should use a safe wrapper such as Apache Common Email and Simple Java Mail which filter special characters that can lead to header injection.

The following code illustrates a vulnerable pattern detected by this rule:

object NotificationMailer {
  @throws[Exception]
  def demonstrate(): Unit = {
    // Each argument carries a line break, which is what splits one header into two.
    compose("Receipt\nX-Priority: 1", "one\nTwo: 2", "Three\nFour", "five\nSix: 6", "7;\n8=9", "../../../etc/passwd")
  }

  @throws[Exception]
  def compose(subject: String, headerValue: String, headerName: String,
              description: String, disposition: String, attachment: String): Unit = {
    val settings = new Properties
    settings.put("mail.smtp.auth", "true")
    settings.put("mail.smtp.starttls.enable", "true")
    settings.put("mail.smtp.host", "smtp.internal")
    settings.put("mail.smtp.port", "587")

    val session = Session.getInstance(settings, new Authenticator () {
    })
    val mail = new MimeMessage(session)
    mail.setFrom(new InternetAddress("notifications@internal"))

    // VULNERABLE: Improper Neutralization of Special Elements used in a Command
    mail.setSubject(subject)

    // VULNERABLE: Improper Neutralization of Special Elements used in a Command
    mail.addHeader("X-Receipt", headerValue)

    // VULNERABLE: Improper Neutralization of Special Elements used in a Command
    mail.addHeader(headerName, "receipt")

    // VULNERABLE: Improper Neutralization of Special Elements used in a Command
    mail.setDescription(description)
    // VULNERABLE: Improper Neutralization of Special Elements used in a Command
    mail.setDisposition(disposition)
    mail.setText("Your receipt is attached.")
    Transport.send(mail)
    new FileDataSource("/var/receipts/" + attachment)
  }

  @throws[MessagingException]

  // Percent-encoding removes the break, but the rule still reports the reachable call.
  @throws[MessagingException]
}

Remediation

Follow secure coding practices and review the references below for detailed remediation guidance.

Configuration

This detector does not need any configuration.

References

© 2026 Xygeni. All rights reserved