Email Injection Attack Part II - More Information
This blog is a follow up to a previous post, on the Email Injection Attack exploit and its occurrence on CF servers. Several questions and comments that were added indicates to me that I wasn't clear enough in describing what I believe is actually occurring. Let me see if I can shed some additional light on the subject.
Let's say you have a contact us form that is sent to "joe@marzipan.com". The email message is set up to be "from" the person making the contact so that joe can easily click reply and respond. The user also has control over a part of the subject and the message. The code would look like this:
#form.message#
</CFMAIL>
Suddenly Joe (your client) calls you and says, "I'm getting spammed by fishy messages!" When you look at the messages in question you see the following.
- The from address is someRandomString@marzipan.com - the same as the clients domain.
- The Message seems to consist of the same address.
- There are 3 or 4 right in a row with similar characteristics.
- There may be a bounced message and it may show an attempted header in the body that says "bcc: someemail@somedomain".
The bot finds a contact page and hit's it 3 or 4 times with several known methods of inserting headers into email messages. For example, it submits as the from address
The important thing to know is that those extra 3 or 4 messages are not spam - but merely probing looking for this vulnerabilty. CF is not vulnerable (as far as I know) to this problem because the CFMAIL tag controls the creation of headers and mail parts using the java mail classes.
So if you see those email messages from your domain explain what is going on to your site owners. Meanwhile there are a few things you can do to "fix" this problem. First, message formats dictate line breaks as the delimiter for headers in a mail message. If you use form parameters in "from" or "subject" you can check for the existence of line breaks and not allow the message if any are found. This is not a perfect solution because there may be browsers that have issues with line breaks - and you may end up shutting out those folks. Let me add, I don't know of any such problems, I'm just trying to cover my but (ha). Here's how you might do it:
--->
<cfif isEmail(form.from) AND NOT find(chr(10),form.from) AND NOT find(chr(13),form.from)>
<Cfmail from="#form.from#" to="joe@marzipan.com" subject="Email From contact form: #form.subj#">
#form.message#
</CFMAIL>
</cfif>
7 Comments
-
I have been looking for a good way of dealing with these attacks so my clients stop calling and asking me what these emails are about.
Maybe you can elaborate a bit on this...
It is my understanding that if you have 8 form fields the bot will try inserting the header info in each of the fields in turn. So, thus you will be receiving 8 emails.
In you example you suggest looking for line break in one of the fields. Am I correct in assuming that as a result you will only get 7 emails from that form when the bot attacks it? And, that to fully stop all emails one would need to check each field for a line break?
Or am I missing something here? -
Mark - I believe you are exactly right. The only field where linebreaks should be present is any "text area" field where the user is sending his "message". If you excluded linebreaks from all fields but that one, then looked for email addresses in the "message" that end in your domain - you would kill 99.99 percent of them (I never say 100 :) -
I just came across this post through a Google search and as I'm having exactly the same problems as you describe I thought I'd give it a shot. I've got all my code in place now but the issue is how do you test it?? :)
I apologise if this sounds like a studpid question but how do you insert Chr(10) and/or Chr(13) characters into a single field?
(I guess this is like becoming a spammer to beat the spammers!!!)
Also, I don't know if this helps but I posted a similar question about this issue on the CFDeveloper.co.uk last year. They came back with a quite simple technique that might be of interest to you as well: http://www.cfdeveloper.co.uk/forum/forum_posts.asp... -
James,
You will probably need to create a custom form - or a test script that does not use form variables. For example you could create a custom form that had a "textarea" instead of a "text" style box - and then post from that box. In some browsers you could create your content (including the chr(10) - chr(13)) in notepad or an editor and then "cut and paste" them into the text field.
In short, there are a lot of ways to do this :) -
Here's a good method I use for ColdFusion. Do a RegEx find on the form e-mail address to make sure it's valid.
<cfif REFindNoCase("^[\w\.-]+@[\w\.-]+\.[a-zA-Z]{2,3}$",form.FORM-EMAIL) gt 0>
... Do your stuff
<cfelse>
<!--- It's not a valid e-mail address --->
</cfif>
This will validate that the passed e-mail address as well as make sure it doesn't contain any illegal characters.
Enjoy! -
I believe I'm seeing the same attacks through a CGI script and don't know how to stop it. (Please see below)
If anyone has any suggestions or knows where I can get a cgi send mail script that doesn't have this HOLE in it I would be most grateful.
Thanks
John Crow
sales@webflare.com (Please e-mail me direct regarding this posting)
FunnyStory = capital8682@sfbaybrides.com
Post_Address = capital8682@sfbaybrides.com
Contact = lues
Content-Type: multipart/alternative;
boundary=84ab459ba4dc49ee8680dc2819fe5273
X-Mailer: Pegasus Mail for Windows (v4.01)
Subject: into the
bcc: billy_the_kid31_1971@yahoo.com
bcc: dbldstrctn@yahoo.com
bcc: kchen@iglide.net
bcc: normanmartha@yahoo.com
bcc: donald_duckny102@standardelectronics.com
bcc: mastaarts@yahoo.com
bcc: topcopl2@aol.com
bcc: bfett7@bluelight.com
bcc: bertlds@cs.com
bcc: pat.reavess@yahoo.com
--84ab459ba4dc49ee8680dc2819fe5273
Content-Transfer-Encoding: 7bit
Content-Type: text/plain
months of arch pril ay. t some point during this time many of the producers
will also rub a paste of
--84ab459ba4dc49ee8680dc2819fe5273
Content-Transfer-Encoding: base64
Content-Type: text/plain
bW9udGhzIG9mIGFyY2ggcHJpbCBheS4gdCBzb21lIHBvaW50IGR1cmluZyB0aGlzIHRpbWUgbWFu
eSBvZiB0aGUgcHJvZHVjZXJzIHdpbGwgYWxzbyBydWIgYSBwYXN0ZSBvZg==
--84ab459ba4dc49ee8680dc2819fe5273--
Sites to Watch
Aggregators
RSS
