E-mail Injection Question

[applefritters]

@Jeff_Mott

Hi, applefritters. For what it’s worth, I think it’s great what you’re trying to do: reproducing a vulnerability so that after you change your code, you can verify the vulnerability no longer exists. Otherwise, how could you tell whether your implementation is safe or whether you’re just not exploiting the vulnerability correctly.

Hi Jeff, and thanks!

@Jeff_Mott

Here’s a simple PHP mail form that would be vulnerable.

There are several ways you could craft your inputs to be malicious. One simple way is in the email field. You could enter a value such as:

me@example.com
To: other@example.com

It starts with the normal email value, which gets used in the From field, then a newline to start a new header. After that newline, you have full control of the email. You can set any header field as well as the body message, which means you can exploit this form to send spam to anyone you want.

What you have said so far is consistent with what I have been reading.

@Jeff_Mott

The solution is to escape special characters. Every output destination has a different set of special characters. If outputting to HTML, you escape angle brackets and quotes, because those are the characters special to HTML. If outputting to SQL, you escape quotes and backslashes. If shell command or JSON, then you escape the special characters of those respective destinations. And so on.

For MIME headers, the newline itself is a special character, among others.

Your options are 1) read rfc2822 very carefully so you can escape correctly, or 2) use a library. I strongly suggest the latter. There are several to choose from, but my top choice is SwiftMailer.

From everything I have read, all I need to look for is Newline and Carriage Return, right?

@Jeff_Mott

Here’s the same script from above but rewritten using Swift.

Even though we’re still using user inputs directly, Swift keeps you safe from injection.

I don’t mean to ignore your suggestion, but my fear is that this is some application I would have to install and configure on my VPS and that is more than I want to do.

Maybe down the road I could look into it, but I am still pretty new to web development, let alone being a system administrator.

The purpose of this thread was to figure out why when I try the hack I was reading about, it doesn’t work. (I think getting beyond that barrier is important, but I’m not sure what to do.)

As far as escaping things, I do have some questions about that topic here…

Questions about Control Characters