CVE-2021-31988: Axis OS SMTP Header Injection Vulnerability

CVE-2021-31988 Overview

CVE-2021-31988 is a CRLF (Carriage Return Line Feed) injection vulnerability affecting multiple versions of Axis OS. The vulnerability exists in the SMTP test functionality where a user-controlled parameter is not correctly validated, allowing attackers to inject Carriage Return (\r) and Line Feed (\n) control characters. This improper input validation enables the inclusion of arbitrary SMTP headers in generated test emails, potentially leading to email spoofing, phishing attacks, or other malicious email-based exploits.

Critical Impact

This vulnerability allows network-based attackers to manipulate SMTP headers in test emails, potentially enabling email spoofing, spam relay abuse, or phishing campaigns through compromised Axis network devices.

Affected Products

• Axis OS (Active Track) - versions prior to security patch
• Axis OS 2016 LTS
• Axis OS 2018 LTS
• Axis OS 2020 LTS

Discovery Timeline

• 2021-10-05 - CVE-2021-31988 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-31988

Vulnerability Analysis

This vulnerability falls under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) and CWE-1286 (Improper Validation of Syntactic Correctness of Input). The SMTP test functionality in Axis OS devices accepts user input that is directly incorporated into SMTP email headers without proper sanitization.

When SMTP test emails are generated, the application fails to strip or encode CRLF sequences from user-controlled input fields. In SMTP protocol, CRLF sequences (\r\n) are used to separate headers, meaning an attacker can terminate an existing header prematurely and inject additional headers of their choosing.

The network-based attack vector requires user interaction but allows an authenticated or unauthenticated attacker (depending on device configuration) to manipulate the email generation process with complete confidentiality, integrity, and availability impact on the affected component.

Root Cause

The root cause of CVE-2021-31988 is insufficient input validation in the SMTP test functionality of Axis OS. The application accepts user input parameters for email generation without properly sanitizing or rejecting CRLF control characters. When these characters are present in user input, they are passed directly to the SMTP email generation logic, allowing header injection.

Proper input validation should either strip CRLF sequences entirely or reject input containing these control characters when processing email-related parameters.

Attack Vector

The attack exploits the SMTP test functionality accessible through the Axis device's management interface. An attacker crafts a malicious input containing CRLF sequences followed by arbitrary SMTP headers. When the device processes this input to generate a test email, the injected headers become part of the email message.

For example, an attacker could inject headers such as Bcc:, Cc:, Subject:, or From: to redirect emails, spoof sender information, or modify email content. In more sophisticated scenarios, attackers could inject complete email body content by adding a blank line (double CRLF) after the headers.

The vulnerability is exploited by inserting characters like %0d%0a (URL-encoded CRLF) into parameter fields that are used in SMTP header construction. See the Axis Security Advisory for complete technical details.

Detection Methods for CVE-2021-31988

Indicators of Compromise

• Unusual SMTP traffic patterns originating from Axis devices
• Test emails containing unexpected headers or recipients
• HTTP requests to device management interfaces containing URL-encoded CRLF sequences (%0d%0a or %0D%0A)
• Log entries showing SMTP test functionality being invoked with abnormally long or suspicious parameter values

Detection Strategies

• Monitor HTTP request parameters to Axis device management interfaces for CRLF injection patterns (%0d, %0a, \r, \n)
• Implement network-level inspection for outbound SMTP traffic from Axis devices with unexpected or spoofed headers
• Deploy SentinelOne Singularity to detect anomalous network behavior from IoT and embedded devices
• Review SMTP server logs for emails originating from Axis devices with irregular header structures

Monitoring Recommendations

• Enable detailed logging on Axis devices and forward logs to a SIEM solution
• Configure email gateway monitoring to flag emails from Axis devices with suspicious header patterns
• Implement network segmentation to isolate Axis devices and monitor cross-segment traffic
• Use SentinelOne's network detection capabilities to identify exploitation attempts targeting embedded devices

How to Mitigate CVE-2021-31988

Immediate Actions Required

• Update all affected Axis OS devices to the latest patched firmware version immediately
• Restrict network access to Axis device management interfaces using firewall rules or network segmentation
• Review and audit any test emails sent from Axis devices for signs of header injection
• Implement web application firewall (WAF) rules to block CRLF injection attempts targeting device management interfaces
• Disable SMTP test functionality if not required for operations

Patch Information

Axis Communications has released security patches addressing this vulnerability. Refer to the Axis Security Advisory CVE-2021-31988 for detailed patch information, affected firmware versions, and upgrade instructions specific to your device model.

Ensure all Axis OS devices are updated to versions that include the fix for CVE-2021-31988. This includes devices running Axis OS Active Track and Axis OS 2016, 2018, and 2020 LTS versions.

Workarounds

• Restrict access to device management interfaces to trusted networks and administrators only
• Implement input validation at network perimeter devices (WAF, reverse proxy) to filter CRLF sequences
• Disable SMTP test functionality through device configuration if it is not operationally required
• Monitor and alert on any SMTP test functionality usage until patches can be applied

# Example: Network segmentation rule to restrict access to Axis device management
# Restrict management interface access to admin network only
iptables -A INPUT -p tcp --dport 443 -s 10.0.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP

# Block common CRLF injection patterns at network edge (example for inspection)
# Note: Implement proper URL decoding before pattern matching
# %0d%0a, %0D%0A patterns should be flagged/blocked in HTTP requests