1336196 - Email Spoofing

Status: RESOLVED DUPLICATE of bug 1285023

(Websites :: Other, defect)

Description

[Sascha]

Hi there,

Similar to this report submitted to Hackerone itself: https://hackerone.com/reports/575

You also are vulnerable to email spoofing.

It came to my attention that due to a lack of mail-server configuration (probably has to do with the way your SPF records are set up, if they are set up), that it is possible to forge emails coming from your domain.

Using an online service called emkei.cz I was able to successfully spoof an email to your domain name, send it to my own email and have it land in the inbox of my email account.

This is a security threat, spoofing emails can be and are used for dangerous spear fishing attacks and misleading people. Therefore, I wanted to bring this to your attention.

Steps to reproduce:
1- Go to https://emkei.cz ( A Fake Mailer )
2- Set the from to parameter as [e-mail] or any other name
3- The email is sent with any content you'd like to add as the message.


Kind regards

Comment 1

[Sascha]

Attachment: 4aa93888ae67206974527834135ee279.png

Comment 2

[Jonathan Claudius [:claudijd] (use NEEDINFO)]

Sascha: thank you for reporting this to us, this is something we are aware of.  This was reported in bug 1285023 and resolved a WONTFIX.