FormMail Recipient CGI Variable Spamming Vulnerability
BID:2469
Info
FormMail Recipient CGI Variable Spamming Vulnerability
| Bugtraq ID: | 2469 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 07 2001 12:00AM |
| Updated: | Mar 07 2001 12:00AM |
| Credit: | Reported to bugtraq by Michael Rawls <[email protected]> on Sat, 10 Mar 2001. Additional significant details and examples were provided in an advisory by "Ronald F. Guilmette" <[email protected]>, which was released on January 23rd, 2002. |
| Vulnerable: |
Matt Wright FormMail 1.9 Matt Wright FormMail 1.8 Matt Wright FormMail 1.7 Matt Wright FormMail 1.6 Matt Wright FormMail 1.5 Matt Wright FormMail 1.4 Matt Wright FormMail 1.3 Matt Wright FormMail 1.2 Matt Wright FormMail 1.1 Matt Wright FormMail 1.0 |
| Not Vulnerable: | |
Discussion
FormMail Recipient CGI Variable Spamming Vulnerability
FormMail is a widely-used web-based e-mail gateway, which allows form-based input to be emailed to a specified user. It is written in Perl and will run on most Linux and Unix variants, in addition to Microsoft Windows operating systems.
A vulnerability exists in FormMail which permits a remote user to send anonymous email to arbitrary recipients.
The script is designed to accept variables from any form and mail them to a specified recipient email address.
The script relies on an HTTP variable for this email address, and provides no indication of the original sender (via the CGI interface) in the email.
This can be employed to send anonymous spam or forged e-mails, potentially in large volumes.
It should be noted that FormMail 1.9 is still prone to this issue. FormMail 1.9 employs measures to attempt to validate the legitimacy of the recipient address. However, it has been reported that these measures may be circumvented via cleverly crafted input.
FormMail is a widely-used web-based e-mail gateway, which allows form-based input to be emailed to a specified user. It is written in Perl and will run on most Linux and Unix variants, in addition to Microsoft Windows operating systems.
A vulnerability exists in FormMail which permits a remote user to send anonymous email to arbitrary recipients.
The script is designed to accept variables from any form and mail them to a specified recipient email address.
The script relies on an HTTP variable for this email address, and provides no indication of the original sender (via the CGI interface) in the email.
This can be employed to send anonymous spam or forged e-mails, potentially in large volumes.
It should be noted that FormMail 1.9 is still prone to this issue. FormMail 1.9 employs measures to attempt to validate the legitimacy of the recipient address. However, it has been reported that these measures may be circumvented via cleverly crafted input.
Exploit / POC
FormMail Recipient CGI Variable Spamming Vulnerability
This issue can be exploited with a web browser.
This issue can be exploited with a web browser.
Solution / Fix
FormMail Recipient CGI Variable Spamming Vulnerability
Solution:
A SourceForge project, entitled nms, has been started to serve as a repository for user-supplied replacements for various Matt Wright scripts. Users intent on using this software should investigate nms at the following URL:
http://nms-cgi.sourceforge.net/
Various workarounds have been suggested which address this issue from various angles. No vendor supplied fix seems to completely address this issue.
Parameshwar Babu <[email protected]> has supplied a patch:
Matt Wright FormMail 1.6
Solution:
A SourceForge project, entitled nms, has been started to serve as a repository for user-supplied replacements for various Matt Wright scripts. Users intent on using this software should investigate nms at the following URL:
http://nms-cgi.sourceforge.net/
Various workarounds have been suggested which address this issue from various angles. No vendor supplied fix seems to completely address this issue.
Parameshwar Babu <[email protected]> has supplied a patch:
Matt Wright FormMail 1.6
-
Parameshwar Babu Mailvalley pppfile.pl
http://www.mailvalley.com/formmail/
References
FormMail Recipient CGI Variable Spamming Vulnerability
References:
References: