1732892 - Email Spoofing to Inbox due to Missing or Misconfigured DMARC on Email Domain (mozilla.org)

Status: RESOLVED DUPLICATE of bug 1285023

(Websites :: Other, task)

Description

[hackingkid2001]

Title: Email Spoofing to Inbox due to Missing or Misconfigured DMARC on Email Domain

Vulnerable URL: mozilla.org

Severity: P4

Hello Team,

I have found a security vulnerability in your site where Email Spoofing to Inbox due to Missing or Misconfigured DMARC on Email Domain

Steps to reproduce:

1. Go to the following URL https://mxtoolbox.com/ and enter your domain mozilla.org
2. You could see DMARC Policy Not Enabled
3. so, with this we can spoof emails from your domain organization
4. Now go to the following URL https://emkei.cz/
5. in, 'From' mail address give your organization email eg: [e-mail]
6. and in 'To' give your email id and click send
7. If you check the mail we could see the message from Ben

Impact:

Spammers can forge the "From" address on email messages to make messages appear to come from someone in your domain. If spammers use your domain to send spam or junk email, your domain quality is negatively affected. People who get the forged emails can mark them as spam or junk, which can impact authentic messages sent from your domain.

POC: Photo attached