IMAP Command Injection: Notes From Testing Mailbox Features

IMAP Command Injection: Notes From Testing Mailbox Features

IMAP command injection shows up when an application speaks IMAP on behalf of a user and pastes attacker-controlled strings into the command stream. Think "search mail," "rename folder," "fetch attachment by UID," or a helpdesk tool that opens a shared mailbox with a ticket ID glued into the SELECT line.

You are not attacking Gmail from the internet. You are attacking the glue between a web app and an IMAP server the program operates or integrates.

Smell the feature first

Public writeups are rare because the surface is uncommon. Prioritize:

• Custom webmail or white-label mailbox UIs
• Security products that archive or search employee mail
• Ticket systems with "import from IMAP" connectors
• Mobile apps that expose advanced search filters to a backend proxy

If the backend never opens an IMAP socket, move on. Confirm with traffic to the mail host from the app server, debug banners, or error messages that quote * BAD / NO IMAP responses. Those errors are gifts—they prove a command reached a parser.

Injection is about structure, not shells

IMAP is tagged commands and quoted strings. A classic mistake:

tag SEARCH FROM "` + userInput + `"

If userInput can close the quote and append another command, you may chain CREATE, DELETE, STORE, or FETCH under the authenticated session. Try:

x" ALL)
A001 CREATE "bf_canary_folder

Exact quoting depends on whether the client uses literals, synchronizing literals, or quoted strings. Some stacks accept a null byte or % / * mailbox wildcards where a single name was expected.

Work only inside accounts you own. Create a canary folder or flag a message with a unique keyword. After the injected request, reconnect with a normal client and show the folder or flag exists. That is enough. Do not mass-delete mailboxes on a shared staging host.

Blind cases and timing

Not every proxy returns IMAP text to the browser. Blind injection still happens: your SEARCH always returns empty, yet a side effect lands. Use CREATE/RENAME of a folder only you will notice, or STORE a keyword on a message you planted.

Watch for second-order issues. A folder name stored in a database and later concatenated into LIST or SELECT is as dangerous as a live search box. Revisit rename and filter-save flows after the first pass.

Rate limits matter. IMAP servers throttle badly written clients. Space probes. One successful canary folder is better than a thousand BAD responses that get your IP banned from the lab.

Reporting without drama

State the authenticated context (your test user), the exact web parameter, the reconstructed IMAP command, and the side effect. Attach a short raw transcript if you have it. Severity tracks impact under that session: reading another folder you should not access is high; creating a folder only you see is usually medium unless it breaks tenancy isolation.

Fixes: use a proper IMAP client library with parameterized arguments, allowlist mailbox names against ^[A-Za-z0-9._/-]+$, and never concatenate into the command tag or atom stream. If the product must support arbitrary folder names, pass them as literals with length prefixes the library controls—not as pasted quotes.

If you cannot show a protocol-level side effect, you do not have IMAP injection yet. You have an interesting error message.