From: "John W. Long" <ng@...>
Date: 2003-08-26T22:11:17+09:00
Subject: Re: Email and smtp.sendmail security vulnerabilities?

Hi,

> > All of the email strings (:from, :to, etc...) could potentially come
from
> > the the outside world. I'm doing some munging on the :from, :to, and
>
> That is your security problem in itself.  Far better would be to
> permit certain addresses only, and let the user choose them by
> passing a hash (such as MD5) of the desired address into the form.
> Thus different addresses cannot easily be created, because only
> those selected addresses will be reverse mapped (md5->address).
> This selection would obviously have to be done from a radio button
> or similar selector.

Well, at any one time I do not intend to allow the user to enter all of the
information. Right now we have an "email this page" form on our web site.
Which allows the user to send a link from our web site to a friend. They
enter their name and email, their friends name and email, and a brief
message. The code then wraps their message with some standard text and the
link. You can see our old form here:

    http://iblp.org/email.asp

This emails something like this to their friend:

<email>
Hi John,

Your friend Bill wants you to visit:

    #{link}

Message:

#{usermessage}

--------------------
The Institute in Basic Life Principles
http://iblp.org
</email>


> Why go to all this trouble?  See
> http://spamcop.net/fom-serve/cache/270.html
> for links to details about formmail which used to be open.
> Basically, anyone could use your script for relaying mail via your
> machine...

While I realize that anyone with enough know how could send mail from the
form, he would have to be willing to send the message with our header and
footer (something I hope would discourage spammers from using our form).

The main thing I want to know is if someone could enter a message that would
add headers to the email or cause the footer not to be displayed, or exploit
some other security vulnerability. Right now I'm preventing the email fields
from having more than one address, and am forcing the name fields to only
have certian characters. The field that I am primarily worried about is the
message field.

--
John Long
http://wiseheartdesign.com