Mail Injection Exploit Warning

A heads-up for any snippet developers involving email:

http://securephp.damonkohler.com/index.php/Email_Injection

Totally unsuspecting script users are getting their sites shut down over this issue.

http://il.php.net/mail (at the bottom, in the user contributed notes)

Validate ALL user input!!!

This URL never explains how to fix the issue:

http://securephp.damonkohler.com/index.php/Email_Injection

I use webmail form snippet and am worried about this. What is the best way to solve this security issue?

Well you might want to add captcha codes to your mail forms

Less intrusive would be to test all input fields with regular expressions, to see if it doesn’t containt weird characters.
Maybe some regexp guru can aid here.

I’m no expert on email security or event PHP security but I’ll throw my two cents in.

ALWAYS hard code the recipient. Don’t ever let user input determine where the email is sent to unless you are working in a very trusted environment.

If you follow the above rule then the only other method that they can use the PHP mail function to send to unintended recipients is if it’s injected through the additional_headers paramater. So your best bet is to not use additional_headers or hard code them. If you must use additonal headers, check your input carefully. Specifically, check for @, CC:, BCC: and other header tags.

That’s the point of the article. You hard-code your recipient, you even maybe hardcode your subject. But a malicious user can inject more into the "your email" input field, or even the body textarea. And they have a nice regexp at the bottom to use in checking your input.

Mostly you need to check for an injection of a linefeed character into the user’s email; it’s just like sql injection, enter a valid email then %0A and whatever you want added to the message headers, including more To lines, Bcc, Cc, whatever you want, even adding boundaries and your own message content when the message is hardcoded!

The thing is, I uploaded their sample mailing app to my site, and tried the injection (I have more than one email, I just tried to "spam" myself), and it didn’t work; all I got was long From: lines with all the code. I must be missing something.

Quote from: sottwell at Aug 10, 2005, 09:59 AM

The thing is, I uploaded their sample mailing app to my site, and tried the injection (I have more than one email, I just tried to "spam" myself), and it didn’t work; all I got was long From: lines with all the code. I must be missing something.

Could be because of a difference in carriage-return code for windows and linux. The method used in the article is correct. But the solution is easy. Check a few keywords in the user input and reject it if it looks suspicious.

Try this article. I would love someone to be able to intergrate it with FormProcessor

http://www.alt-php-faq.org/local/115/

Quote from: Mark at Aug 09, 2005, 01:31 PM

This URL never explains how to fix the issue:

http://securephp.damonkohler.com/index.php/Email_Injection

I use webmail form snippet and am worried about this. What is the best way to solve this security issue?

The article recommends looking in input for non-valid characters. This is a fundamentally flawed approach as it’s very unlikely that you’ll be able to spot *every* kind of weird encoding a cracker would use to bypass your security.

A more sane approach would be to allow through only known good text. I.E., don’t bother looking for bad code in your input. Only allow [A-Za-z0-9\.\@\-] or something similar to prevent bad stuff from getting through.

Quote from: web_designer at Aug 30, 2006, 06:40 AM

Try this article. I would love someone to be able to intergrate it with FormProcessor

http://www.alt-php-faq.org/local/115/

That article, while well meaning, is extremely naive in its handling of potentially bad data. It’s far too easy to get past their checks by simply encoding your strings differently. See my previous post on a better way to do this.