4 ms·
* Accepting the email address to send token to from web user, validating the address, and then using the user input directly as the email address t
by ghuntley 11y ago
* Accepting the email address to send token to from web user,
validating the address, and then using the user input directly
as the email address to send the token to; as in: systems that
will send token to user@real.com;attacker@evil.com.
Ouch, that's really devious and extremely clever.
- noir_lord 11y agoI think that might work on one of the apps I maintain. Sigh adds to wunderlist
- __david__ 11y agoI'm missing something here... How does "user@real.com;attacker@evil.com" validate as "user@real.com"? Is this a regexp vs strcmp() issue or is there something more subtle at play?
- pfg 11y agoOne scenario I can imagine is a regex which doesn't properly handle multi-line inputs (quite common issue in ruby[1]). Together with a mail header injection vulnerability, this input could be dangerous: user@real.com\nCc:attacker@evil.com [1]: http://guides.rubyonrails.org/security.html#regular-expressions http://guides.rubyonrails.org/security.html#regular-expressi...
- mpeg 11y agoMight have been validated in step1, but the email goes out to the email in a hidden field in step2, etc.
- mikeash 11y agoTotal speculation, but maybe they're trying to be clever and accept things like "John Doe <john@doe.com>" as being equivalent to "john@doe.com" and end up using a full e-mail parsing library for the matching which is more capable than they realize?
- AUmrysh 11y agoIt may send it to multiple addresses. I know in outlook and in .NET libraries, the semicolon is the delimiter for multiple email addresses.