4 ms·
I'm missing something here... How does "user@real.com;attacker@evil.com" validate as "user@real.com"? Is this a regexp vs strcmp() issue or is there something m
by __david__ 11y ago
I'm missing something here... How does "user@real.com;attacker@evil.com" validate as "user@real.com"? Is this a regexp vs strcmp() issue or is there something more subtle at play?
- pfg 11y agoOne scenario I can imagine is a regex which doesn't properly handle multi-line inputs (quite common issue in ruby[1]). Together with a mail header injection vulnerability, this input could be dangerous: user@real.com\nCc:attacker@evil.com [1]: http://guides.rubyonrails.org/security.html#regular-expressions http://guides.rubyonrails.org/security.html#regular-expressi...
- mpeg 11y agoMight have been validated in step1, but the email goes out to the email in a hidden field in step2, etc.
- mikeash 11y agoTotal speculation, but maybe they're trying to be clever and accept things like "John Doe <john@doe.com>" as being equivalent to "john@doe.com" and end up using a full e-mail parsing library for the matching which is more capable than they realize?
- AUmrysh 11y agoIt may send it to multiple addresses. I know in outlook and in .NET libraries, the semicolon is the delimiter for multiple email addresses.