PraisonAI: IMAP Command Injection via Unsanitized Email Search Parameters
Summary
The email search tool in src/praisonai-agents/praisonaiagents/tools/email_tools.py constructs IMAP SEARCH commands by interpolating LLM-controlled parameters (from_addr, subject, query) directly into IMAP protocol strings using f-string formatting with double-quote delimiters. An attacker who can influence the arguments to the search_emails or reply_email tool (via crafted agent prompts) can inject arbitrary IMAP commands, potentially exfiltrating email data from other folders, deleting emails, or performing other unauthorized IMAP operations.
Details
Vulnerable code (lines 493–502):
criteria = []
if from_addr:
criteria.append(f'FROM "{from_addr}"')
if subject:
criteria.append(f'SUBJECT "{subject}"')
if query:
criteria.append(f'TEXT "{query}"')
if not criteria:
criteria.append("ALL")
search_str = " ".join(criteria)
status, data = mail.search(None, search_str)The from_addr, subject, and query parameters originate from LLM tool call arguments (the search_emails public function at line 665). These values flow through without any sanitization or escaping. The double-quote (") characters in these parameters allow breaking out of the IMAP SEARCH quoted string context.
Additional injection points:
- Line 416:
mail.search(None, f'HEADER Message-ID "{search_id}"') - Line 447: Same pattern in
_smtp_reply_email - Line 542: Same pattern in
_smtp_archive_email
The search_id / message_id parameter in these functions is also LLM-controlled via the reply_email and archive_email public tool functions.
Reachability: The search_emails, reply_email, and archive_email functions are exposed as agent tools. They are reachable when an agent is configured with email tools (EMAIL_ADDRESS + EMAIL_PASSWORD environment variables set). This is a documented deployment scenario for email-capable agents.
PoC
Setup: Requires an IMAP server (not run here — this is a static proof). The vulnerability is demonstrated by tracing the data flow.
Positive trigger — IMAP injection via search_emails:
An LLM agent processing a crafted prompt calls:
search_emails(from_addr='[email protected]" LOGOUT')SEARCH FROM "[email protected]" LOGOUT"LOGOUT command is injected after the prematurely closed quoted string, causing the IMAP connection to be terminated.More severe injection — exfiltrate emails from another folder:
search_emails(query='" SEARCH RETURN (MIN) ALL')TEXT "" SEARCH RETURN (MIN) ALL" — injects a secondary SEARCH command.Negative control — legitimate search:
search_emails(from_addr='[email protected]')FROM "[email protected]" — correct, no injection.Cleanup: No persistent changes for read-only injection. For destructive injection (DELETE, EXPUNGE), impact persists.
Impact
An attacker who can craft prompts that cause an LLM agent to call search_emails with injection payloads can:
- Terminate IMAP connections (denial of service)
- Inject arbitrary IMAP commands — including LIST (enumerate folders), SELECT (switch folders), FETCH (read emails from other mailboxes), STORE (modify flags), COPY/MOVE (move emails), DELETE/EXPUNGE (permanently delete emails)
- Exfiltrate email contents from folders the user did not intend to expose to the agent
- Permanently delete emails via injected DELETE + EXPUNGE commands
The attack requires the IMAP backend to be configured (EMAIL_ADDRESS + EMAIL_PASSWORD env vars), which is a documented and common deployment for email-capable agents.
Suggested remediation
- Escape double-quote characters in IMAP parameters. Per RFC 3501, literal strings use
{n}\r\nformat or quoted strings with\escaping:
def _escape_imap_string(s: str) -> str:
"""Escape a string for safe use in IMAP quoted strings."""
# Use IMAP literal syntax for safety: {length}\r\n
encoded = s.encode('utf-8')
return f'{{{len(encoded)}}}\r\n{encoded}'- Use IMAP literal syntax (
{n}\r\ndata) instead of quoted strings for all user-controlled parameters. This prevents any injection regardless of content. - Apply the escaping to all IMAP search criteria parameters:
from_addr,subject,query, andsearch_id/message_id.