619929 - Send spams through mozilla mail server

Status: RESOLVED FIXED

(www.mozilla.org :: General, defect)

Description

[schuenjia]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 6.1; de; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Build Identifier: 

The user input "email" is not properly validated so that an attacker can use the sendmail function to automatically send spam emails to any one.

Reproducible: Always

Steps to Reproduce:
1. POST http://www.mozilla.org/contribute/email/index.php
2. with email: [e-mail]\r\nTo:[e-mail]\r\nTo:[e-mail]

Comment 1

[schuenjia]

It's just an example, please check also other input fields like $area.

Comment 2

[David Chan [:dchan]]

I am unable to reproduce this issue.

My steps
1. Go to http://www.mozilla.org/contribute/
2. Fill out the Get In Touch option with burp running
3. Replace address parameter with the string provided

I received a HTTP/1.1 200 OK with the content
Must use a valid e-mail address

I also tried POSTing to 
http://www.mozilla.org/contribute/email/index.php
with the same results

Am I missing a step?

Comment 3

[schuenjia]

sorry, please try this vector:

address: 
xxx\r\nTo:[e-mail]

Comment 4

[David Chan [:dchan]]

(In reply to comment #3)
> sorry, please try this vector:
> 
> address: 
> xxx\r\nTo:[e-mail]

Thanks. I was able to reproduce with that vector.

The problem appears to be in the validate_email function which is too permissive.

http://viewvc.svn.mozilla.org/vc/projects/mozilla.org/trunk/contribute/email/index.php?revision=68785&view=markup

Comment 5

[David Chan [:dchan]]

Attachment: proposed patch

Change the [^@]+ to [a-zA-Z0-9._\-+]+

Comment 6

[Reed Loden [:reed]]

Comment on attachment 498781 [details] [diff] [review]
proposed patch

r=me

Comment 8

[David Chan [:dchan]]

This appears to be fixed. Submitting the previously working string of
xxx\r\[e-mail]
now returns an error to enter a valid email. This was probably fixed in the rewrite.

Closing bug