SMTP Injection-Part I

Yet another injection attack! Same cause- Failure to validate user input. The application which I was assessing was almost injection free- means all the known issues like SQL Injection, XSS etc were not present until I found SMTP injection!

The application had one feedback/suggestion form, through which user can submit their comments. Typically, user-supplied input will be inserted into the SMTP conversation that the application server conducts with the mail server.
The form was having the following fields:
Your email address: Where user has to enter his email id
Subject: Enter the subject
Comments: User can put his comments
Entering the above information the user can submit the form by clicking on a nice Submit button. The mail will be fired to Admin of the website and few other stakeholders too.

So, for example if we specify the following:
Your email address: nileshkumar83@gmail.com
Subject: Flaws in the website
Comments: Your website has the lots of flaws that can be exploited..blah..blah.

Ideally clicking on Submit button should fire the email to Admin and few stakeholders not to anybody else!

Now suppose I inject the following in the Your email address field:
nileshkumar83@gmail.com%0aBcc:allotherpeople@thecompany.com

So this causes the mail command to generate the following headers:

To: admin@thecompany.com;stakeholder@thecompany.com
From: nileshkumar83@gmail.com
Bcc: allotherpeople@thecompany.com
Subject: Flaws in the website
Your website has the lots of flaws that can be exploited..blah..blah.

The %0a translated into new line and then follows Bcc command which send the mail to other people silently who are not directly concerned with the message.
So it may be used to create spam messages or malign anybody's image.
Another variant of the SMTP Injection is SMTP command injection in which can cause to create an entirely new message in which you can control the From headers as well. That is more dangerous. We'll talk about that in next part.

Comments

Popular posts from this blog

SQL Injection in search field

File Upload through Null Byte Injection