1366546 - Email Spoofing in mozilla.org

Status: RESOLVED DUPLICATE of bug 1285023

(Websites :: Other, defect)

Description

[Abartan Dhakal]

Attachment: One can pretend he is from mozilla and can take over the sensitive information from users.

There is an Email Spoofing Vulnerability.
Steps to reproduce:
1) Go to http://emkei.cz/
2) Fill "From Email" field to [e-mail] or any other mozilla email.
3) Fill the victim's address (your address) to "TO" field and fill in other details as you wish.
You will receive email from mozilla admin.
Reference:
https://hackerone.com/reports/575
Thank you for time and consideration you provided for reading my report.
The emails hits spam box on gmail and inbox on Yahoo.
I am attaching the POC images on my emails
Thanks

Regards
Abartan Dhakal
Security Researcher
Roshan Labs

Comment 1

[April King [:April]]

This is a known issue with mozilla.org not yet implementing DMARC, but thank you for investigating and participating in our bug bounty program.