Email Header Injection: How to Test Contact Forms and Mail Bugs
Email header injection happens when user input is concatenated into mail headers (Subject, From, Reply-To, CC, BCC). Newlines let an attacker add headers and sometimes smuggle extra recipients or a second message body.
Impact ranges from spam relay to phishing that looks like it came from the victim company.
Likely sinks
- Contact / support forms
- “Share by email” features
- Invite-a-friend flows
- Server-side templates that build raw RFC 822 messages
Safe testing method
- Find a field reflected into outbound mail (subject or name often works).
- Inject a newline and a test header, for example a unique
X-Bugflare: <id>if you can view raw mail, or aBCC:to an inbox you control when the program allows mail tests. - Prefer staging and program-provided sink accounts. Do not BCC strangers.
If the program forbids sending mail, report based on code patterns or a ticket that shows raw headers in an admin mail log you are allowed to see.
Impact
- Extra hidden recipients on support mail
- Spoofed
From/Reply-Tothat enables phishing - Filter bypass and reputation damage for the domain
Report tips
Include the exact payload, the resulting raw headers (redacted), and the mailbox you control. Suggest using a mail API with structured fields — never string-build headers.
Defensive checklist
- Reject CR/LF in any field that touches headers.
- Use libraries that set headers via parameters, not concatenation.
- Fix
Fromto a server-controlled identity; put user input in the body only. - Rate-limit forms and monitor spikes.
Email injection is header injection with an inbox. If a form can touch mail headers, test the newline.
Original Bugflare guide informed by OWASP email injection guidance.