WebFORM and FORM2MAIL Open Email Relay Vulnerability

Bugtraq ID:	18434
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 09 2006 12:00AM
Updated:	Jun 15 2006 08:16PM
Credit:	Business Architects are credited with the discovery of these vulnerabilities.
Vulnerable:	CGI-Rescue WebFORM 4.1 CGI-Rescue FORM2MAIL 1.21
Not Vulnerable:

WebFORM and FORM2MAIL Open Email Relay Vulnerability

WebFORM and FORM2MAIL are prone to a remote open-mail-relay vulnerability because they fail to properly sanitize user-supplied input before using it to generate email messages.

An attacker may leverage the issue to use webservers that are hosting the vulnerable software to send arbitrary unsolicited bulk email. Attackers may also forge email messages that originate from trusted mail servers.

WebFORM and FORM2MAIL Open Email Relay Vulnerability

This issue can be exploited through a web client.

WebFORM and FORM2MAIL Open Email Relay Vulnerability

Solution:
The vendor has released a new version of the application that addresses this issue.


CGI-Rescue FORM2MAIL 1.21

• CGI-Rescue FORM2MAIL version 1.22
  Upgrade to FORM2MAIL version 1.22
  http://www.rescue.ne.jp/cgi/form2mail/

CGI-Rescue WebFORM 4.1

• CGI-Rescue WebFORM version 4.2
  WebFORM version 4.2
  http://www.rescue.ne.jp/cgi/webform/

WebFORM and FORM2MAIL Open Email Relay Vulnerability

References:

• WebFORM and FORM2MAIL (JP Vendor Status Notes)
  
• WebFORM and FORM2MAIL Homepage (CGI-Rescue)