Email Smuggling with Differential Fuzzing of MIME Parsers

A single email gets parsed multiple times: by the mail server receiving the email, by virus or spam filters, and finally by the mail client that displays the email to the user. MIME (Multipurpose Internet Mail Extensions) is a standard that extends the format of email messages, allowing them to include multimedia content, attachments, and non-ASCII text. Ensuring that email content is correctly formatted and interpreted across different systems is crucial. Differentials in how applications parse the same MIME message can have security implications. For instance, a virus or spam filter might ignore part of the data that ends up being processed by the mail client. We present experiments with differential fuzzing to discover differentials in how MIME parsers handle the same message. We investigate the root causes and see if the differentials can be exploited. Our research reveals many parser differentials in MIME parsers, including some that can be exploited to smuggle emails past virus and spam filters. On top of that, our experiments found many memory corruption bugs.