689138 - Mozillians sends e-mail to destination server directly from webserver host

Status: VERIFIED WONTFIX

(Participation Infrastructure :: Phonebook, defect, P2)

Description

[Mark Goodwin [:mgoodwin]]

This bug is more for discussion than anything else.

Issue:
Mozillians sends e-mails (e.g. for the 'invite' functionality). These e-mails are sent directly from the webserver serving the users' requests rather than going via an MTA dedicated to the task of processing mail for external recipients.  The issue with this is that it allows an attacker to use system generated e-mail as a network discovery tool. 

Steps to reproduce:
1) log in to mozillians using a vouched account
2) click on 'Invite'
3) enter an (invalid) e-mail address in the address field
4) click 'send invite'
5) look at the e-mail address you used to register your mozillians account
6) Observe the internal host information included in the e-mail

Recommended remediation:
This is left open for discussion; I realise we do this in other places so fixing this might not be the best course of action. I've created this bug as a starting point for discussion between the infra and security teams.

Comment 1

[Fred Wenzel [:wenzel]]

I think it depends on what settings are set in the Django config file? Unless I am mistaken, those can handle SMTP credentials, which would allow it to use a smarthost.

Comment 2

[Corey Shields [:cshields]]

We usually send through an MTA, in this case we should send through mxout-generic.mozilla.org

but still, the header would show the originating host.

Comment 3

[Aakash Desai [:aakashd]]

This isn't hitting the 1.1 release as we're code frozen. Moving this to 1.2.

Comment 4

[Fred Wenzel [:wenzel]]

Uh, from comment 2, this might not even be an issue, but we should double check.

Comment 5

[Aakash Desai [:aakashd]]

Taking this out of release scheduling until its determined this is an issue.

Comment 6

[Ben (:bensternthal)]

Triaging... 

Can we identify if we need to fix something or if this is a non-issue.. attached is a screenshot of the email headers from mozillians.

I poked around and the bedrock email (from contribute) look similar.

So if we need to fix something on mozillians its likely we have to fix elsewhere.

Comment 7

[Ben (:bensternthal)]

Attachment: Email Header Screenshot From Stage

Comment 8

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

Whether or not this is fixed is ultimately a decision point for you all. We wanted to raise the issue as a discussion point. As noted in comment 0 we do this in other places. If used this would not be a direct attack but would be used to gather more information to possibly make a different attack possible. That said mgoodwin might have more to say on this

Comment 9

[William Reynolds [:williamr]]

Mark, do you anything else to add?

Is this something we need to fix or is this a non-issue? It seems like the decision should be made by the infra and security teams, although let me know if our project team should decide. Thanks!

Comment 10

[Mark Goodwin [:mgoodwin]]

I think it's a low risk issue; we most likely have bigger fish to fry. Feel free to close it out.

Comment 11

[Giorgos Logiotatidis [:giorgos]]

Closing this bug based on comment #10. 

Thanks for the input everyone ;)

Comment 12

[Matt Brandt [:mbrandt]]

QA verified wontfix