Closing a PHP Mail Form Vulnerability

I wrote a PHP script that accepts e-mail from web site visitors using a feedback form. The script works with different sites, routing mail to the right inbox with a hidden field on the form:

The who field doesn't specify an e-mail address, because that would be easy pickings for spammers. They crawl the web looking for e-mail scripts that can be configured to send e-mail to any recipient they specify.

Instead, my script was written to send mail only to accounts on my server:

$recipient = $_REQUEST['who'];

if ($recipient == "") {
$recipient = "rogers@ekzemplo.com";
} else {
$recipient = $recipient . "@ekzemplo.com";
}

Recently, a spammer found a way to make my script send e-mail to anyone on any server, generating hundreds of spams on my machine over a space of four days.

I'm curious to see if any programmers spot the giant honking vulnerability in the preceding code that I missed for months.

Programming · Php · Security · 2005/11/19 · 13 COMMENTS · Link

Comments

$recipient = "greg@eod.com; rogers";

Also, we need to talk about your brace style.

Heh.

#1 · Greg Knauss · 2005/11/19

Note to self: crank up the aggregator refresh rate, so you get there while the question's still open, not after the One True Brace Style "discussion" has started.

#2 · Phil Ringnalda · 2005/11/19

I figured it wouldn't take long, but eight minutes? Dr. Ecco's Omniheurist Corner this ain't.

#3 · Rogers Cadenhead · 2005/11/19

Talk about late to the game, I'm here after Visitor. I notice Rogers isn't using rel="nofollow" on those links.

I was going to suggest

$recipient = "greg@example.com ";

since the failure to deliver to "@ekzemplo.com" won't stop greg's mail from going through, although if you read your postmaster mail, you might have noticed the spate of failures. I guess that is actually less likely than noticing the spam to "rogers@ekzemplo.com"

A thrifty, lazy or ambitious spammer could also send more than one mail at a time

$recipient = "greg@example.com, phil@example.com, rogers@example.com, ray@example.com, et@example.com, cetera@example.com ";

#4 · Ray · 2005/11/19

That's what the spammer did -- 20-25 recipients at a time.

#5 · Rogers Cadenhead · 2005/11/19

Rogers,

Before you do ANYTHING with input from 3rd party sources, you should "sanitize" it and only allow through characters that you think are legit - here's an example of the basic idea of what I do. There's more validation checking you should do, but this is an excellent first step to ensure the input is semi-legit.

alek

foreach $_ ( sort keys %ENV ) {
$value = $ENV{$_};
$value = sanitize($value);
}
Never use $ENV after that.

sub sanitize {
my $input = $_[0];
my $OK_CHARS='() "/.,'_@&#-+:=!?a-zA-Z0-9';
$input =~ s/n/__n__/g;
$input =~ s/r/ /g;
$input =~ s/[^$OK_CHARS]/___/go;
return $input;
}

#6 · alek · 2005/11/20

Things that I do that will help the script above:

1. use str_replace to change ";", ":", "," and so forth to " " (a space);
2. explode the 'to' string, using " " as the delimiter;
3. only send the email to $whoarray[0] -- or perform more checks on $whoarray[0] to verify it's OK. At least this way, your default will not fail (explode-ing a string with no delimiters returns the entire string), but they cannot slip multiple email addresses on a single line. If they have to delimit it to send multiple emails, make sure you break up their delimiters, too.

#7 · Derek Dahlsad · 2005/11/21

I wrote an essay for work about the need for escaping; I really need to get around to cleaning it up for public posting this week.

Buffer overflows are the number one security problem, but this sort of problem is number two, coming up on #1 fast, and going to be harder to eliminate the way a language like Java can (nearly) eliminate buffer overflows.

#8 · Jeremy Bowers · 2005/11/21

I'm a programmer and I wrote an email form in php (multilanguage) which seems to satisfy my privacy :-)

alecos.altervista.org

try it !

Best regards.

Alessandro Marinuzzi

#9 · Alessandro Marinuzzi · 2006/01/07

Hi Rogers,

I had a similar problem of a mail form script getting exploited.

In my case it was due to injection of headers. Which your code is not yet safe from.

Check out: securephp.damonkohler.com

...for the scary details. Basically, like the sanitize comment above, you need to remove line feeds from all variables that will get sent to your system mail function.

Lev

#10 · Lev from Denver · 2006/02/03

Hello

Somebody hacked my mailsending script wich was password protected. The script alowwed anybody with the right username and password to send mail anywhere they liked. The hacker sent 50 000 mails in two days.

#11 · Rich · 2006/02/19

#12 · visitor · 2006/04/20

Hi! The problem of headers injection is solved using this code:

$antispam = array("rn","r","n","%0a","%0A","%0d","%0D",";","Content-Type:","to:","cc:","bcc:");
$name = str_replace($antispam, "", stripslashes($_POST['name']));
$subject = str_replace($antispam, "", stripslashes($_POST['subject']));
$mail = str_replace($antispam, "", stripslashes($_POST['mail']));

$message is the 3 parameter in mail() function and doesn't need to be cleaned since the problem came with the 4 parameter in mail() function.

Bye bye :-)

#13 · Alessandro Marinuzzi · 2007/01/29