Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability exists because several methods in the Net::IMAP library accepted raw string arguments and sent them to the IMAP server without proper validation or escaping. An attacker could provide a string containing CRLF (carriage return, line feed) sequences to inject new, malicious IMAP commands, leading to command injection.
The analysis of the provided patches confirms that the following methods were vulnerable:
setquota: It used string concatenation to build a command with a user-provided limit, which was then wrapped in RawData.store and uid_store: They wrapped the string attr argument in RawData via the store_internal method.search, uid_search, fetch, and uid_fetch: These methods wrapped string arguments (criteria and attr) in RawData to allow for low-level, flexible queries.The patches implement two types of fixes:
setquota, store, and uid_store, the use of RawData for the vulnerable arguments was removed entirely. The arguments are now treated as structured data (Integer, Atom), which the library safely encodes.search, uid_search, fetch, and uid_fetch, which retain RawData for flexibility, the RawData class itself was fundamentally changed. It now parses the input string into text and literal parts and, crucially, validates the text parts to ensure they do not contain unescaped CRLF, NULL, or invalid UTF-8 sequences, thus preventing the command injection.| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| net-imap | rubygems | >= 0.6.0, <= 0.6.3 | 0.6.4 |
| net-imap | rubygems | >= 0.5.0, <= 0.5.13 | 0.5.14 |
| net-imap | rubygems | >= 0, <= 0.4.23 | 0.4.24 |