1

We have a client website using Sprout Forms for a contact form. The client has queried a number of security topics with us, one of which is about Mail Header Injection attack protection (https://www.acunetix.com/blog/articles/email-header-injection/).

I've reached out to Ben at Barrel Strength and his response was that Sprout Forms uses the default Craft email service so any security steps Craft is taking they're piggybacking on.

The site is currently using the PHP Mail email setting.

Does the Craft email service have any protection / validation in place to mitigate against potential Mail Header Injection attacks or would we need to implement any updates to protect against this?

2

Does the Craft email service have any protection / validation in place to mitigate against potential Mail Header Injection attacks

Yes.

Attacks like this, for the most part, are really only a concern for PHP apps that roll with their own custom email logic instead of using a widely used/tested email library. Craft 2 uses PHPMailer and Craft 3 uses SwiftMailer.

And they both provide methods for stripping out newlines to prevent header injection attacks.

  • 1
    Thanks for the response Brad. That's a very helpful description to return to our client with. – Steve Rowland Jun 23 '17 at 9:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.