4 ms·
I found this write-up a bit confusing and hard to follow. The vulnerability is that any SendGrid user could configure a webhook callback which would POST back
by zaroth 10y ago
I found this write-up a bit confusing and hard to follow.
The vulnerability is that any SendGrid user could configure a webhook callback which would POST back all received emails for any domain which had its MX set to 'mx.sendgrid.net'. OP exploited this against Uber to receive copies of their emails.
Presumably there was no way to tell from one account that another account is web-hooking your email out from under you. So you have to wonder, if it's as easy as just typing the domain you want to listen in on.... who else was getting all their emails tapped this way?
From Sendgrid's documentation;
Setup
The following steps are required to begin
parsing email:
Point the MX Record of a Domain/Hostname or
Subdomain to mx.sendgrid.net
Associate the Domain/Hostname and the URL in
the Parse API settings page.
Shocking omission by Sendgrid, where's their write-up and apology?
- deleted 10y ago[deleted]
- downandout 10y agoThe problem is on SendGrid's side, however I doubt they would have paid $10K for it. He was smart to take it to Uber, who is likely (by far) SendGrid's largest customer, and who certainly has much deeper pockets than SendGrid.
- uraniumhacker 10y agoAt the time of the exploit, there was only one check, the MX record. Also once I claimed the domain, another user cannot claim it from their account. So this could be exploited silently as well because the victimized company won't know about it for a while.