From: John Long <JLong@...>
Date: 2003-08-27T04:03:35+09:00
Subject: Re: Email and smtp.sendmail security vulnerabilities?

Hi,

> > While I realize that anyone with enough know how could send 
> mail from the
> 
> But it isn't much know how: it is only constructing a URL.  Then the
> "spam" comes via your domain, and you get blacklisted.

> Spammers don't seem to care much how their message is delivered.
> This statement is anecdotal, of course. Add a tablespoon or 4 of
> salt, to taste.

How would you suggest we implement this feature on our web site?

Technically someone could send a link from the iblp web site to a million
people and get us black listed, but the chances of this happening are
relatively slim. Talking with our IT department head here he said that the
way most blacklists work is by checking to see if you are running open
relay. If you are then they blacklist you. We wouldn't be running open relay
so that wouldn't be a problem. Also if that occured the hits to that page
would suddenly sky rocket.

> > The main thing I want to know is if someone could enter a 
> message that would
> > add headers to the email or cause the footer not to be 
> displayed, or exploit
> > some other security vulnerability. Right now I'm preventing 
> the email fields
> 
> I've not looked in that much depth.  I think this is a serious
> enough flaw to make that much less significant.

Again the main field I am concerned about is the message field.
 
> Another quick look throws up:  You have not trapped ';' although you
> don't pass this directly to a shell, so you should be OK.
> When you expand the string with #{} they can find out things like
> $RUBY_PLATFORM and such, which may reveal more about your system
> than you wish to reveal.

I'm not quite sure what you mean here. Can you give an example of someone
getting the Ruby Platform that way?

irb(main):001:0> a = "RUBY_PLATFORM"
=> "RUBY_PLATFORM"
irb(main):002:0> j = "#{a}"
=> "RUBY_PLATFORM"
irb(main):003:0>

When I use this class on my page I actually do some checking to insure that
only one email address is entered and a few other things.
 
> The Body cannot become part of the headers, even with vertical tabs,
> I think.

This would be my guess too. But I would like to know for sure.

> The Message id may not be unique, since you only use time.current.
> You may need $$ and possibly Thread.current as well to guarantee 2
> concurrent submissions having unique ids.

Interesting point. What does $$ stand for?

> I don't seem to have enough low cunning to think of all the holes
> that others are able to point out.
> 
> You also may wish to limit submissions from/to an address in a given
> period to prevent automated mail bombing.
> 

Something to consider I guess. But probably not worth the extra effort on
this front. For now we will just continue checking our site statistics on a
regular basis.

How does what we are doing differ from what major news sites are doing (eg.
msnbc.com, cnn.com)? What would prevent me from using their sites to send
spam?

--
John Long
jlong@iblp.org