[34689] in bugtraq
Re: Spammers can hide behind 'Email a friend/article' scripts.
daemon@ATHENA.MIT.EDU (matthias@astrum.ch)
Tue Apr 27 20:35:45 2004
Message-ID: <65135.193.134.170.35.1083046520.squirrel@webmail.astrum.ch>
In-Reply-To: <20040426202613.23962.qmail@www.securityfocus.com>
Date: Tue, 27 Apr 2004 08:15:20 +0200 (CEST)
From: matthias@astrum.ch
To: bugtraq@securityfocus.com
MIME-Version: 1.0
Content-Type: text/plain;charset=iso-8859-1
Content-Transfer-Encoding: 8bit
> # Description: Spammers can hide behind 'Email a friend/article' scripts.
These are just an instance of the more general form hijacking attacks. I've
seen several attempts to abuse feedback forms and similar through a simple
scheme - each form field was filled with
"To: <someaddr>\nFrom: <someaddr>\n"
Form scripts that do not check for newlines within the fields are vulnerable
to those attacks in general, for example in perl pseudocode:
open(SENDMAIL, "|/usr/sbin/sendmail -someflags")
or print "Some Error: $!\n";
print SENDMAIL "From: $formfield_from\n";
print SENDMAIL "To: $recipient-taken-from-some-config\n";
print SENDMAIL "Subject: Foo Bar '$formfield_subject'\n";
print SENDMAIL "\nMail content\n";
close(SENDMAIL);
If $formfield_subject contains the above line with additional To:s, it
depends on the MTA whether he parses the additional headers and sends
them along.
Around end of march/beginning of april 2004 I've seen a number of attempts
to abuse such scripts. It look like a systematic approach and not some
random guesses.
-- Matthias
--
Matthias' Braindump http://matthias.leisi.net/
