Re:PHPMailer Exploit – Remote Code Execution
by annnnd on Wednesday December 28, 2016 @05:30AM
(#13269676)
Genuinly curious: does '+' trick work? I would imagine any infringing parties would learn to remove plus sign and all after it before selling the database of addresses by now...
Other than that: true, I hate incorrect validation. But I hate sloppy security practices even more.
Re:PHPMailer Exploit – Remote Code Execution
by thaumaturgy on Wednesday December 28, 2016 @05:43AM
(#13269713)
Not as much as it used to. You're right, they've caught on to it. I need to stand up another mail server pretty soon, I want to try making it easy to generate random recipient aliases, so e.g. [email protected] is an alias for [email protected] and [email protected] is an alias for [email protected]. That oughtta stump 'em for a while.
Re:PHPMailer Exploit – Remote Code Execution
by danieltillett on Wednesday December 28, 2016 @04:45AM
(#13269536)
Sometimes not allowing a "+" is an anti-abuse feature. If you have a service tied to a customer providing a unique email address then you don't want them able to use a "+".
Re:PHPMailer Exploit – Remote Code Execution
by jackweirdy on Wednesday December 28, 2016 @04:52AM
(#13269558)
That seems like a strange place to verify that a user is only allowed to create one account. After all, they could just create a second email account on a free email provider and use that to sign up.
To get around that, the service provider would have to verify identity further down the line, making the email format restriction redundant.
Re:PHPMailer Exploit – Remote Code Execution
by danieltillett on Wednesday December 28, 2016 @05:12AM
(#13269619)
I have been down this route and you also have to disable the use of free email accounts.
If the service value is not too high then even making people who want to abuse the service go through the process of registering a free email account works. Put a little bit of friction into the process and the script kiddies move onto an easier target.
Re:PHPMailer Exploit – Remote Code Execution
by iopq on Wednesday December 28, 2016 @07:24AM
(#13270049)
> I have been down this route and you also have to disable the use of free email accounts.
I don't have any other email. Seems like a really bad idea.
Re:PHPMailer Exploit – Remote Code Execution
by danieltillett on Thursday December 29, 2016 @04:59AM
(#13276531)
It depends on the service. Some services are only aimed at business which have their own domain, but yes I agree this is a pretty drastic step to take.
Re:PHPMailer Exploit – Remote Code Execution
by adjkant on Wednesday December 28, 2016 @04:05AM
(#13269391)
I somehow went through life not knowing the + trick. Thanks, and commenting to hopefully highlight this for anyone else who didn't know.
Re:PHPMailer Exploit – Remote Code Execution
by thaumaturgy on Wednesday December 28, 2016 @04:32AM
(#13269483)
The specific character depends on your MTA configuration. In Postfix this is the recipient_delimiter setting. I went with a "+" because that's the same character Gmail uses. Other mail services may not support this feature. Hope this helps!
It's also why I far-too-often run into forms that won't let me use a "+" in the username part of my email address, which I use to track who's responsible for sending my email account off to third parties (e.g., "rob+paypal@....").
Some kinds of email validation are better than others. Using regular expressions and strictly adhering to the RFC is the one that developers are usually talking about when they say not to do it. filter_var(..., FILTER_VALIDATE_EMAIL) is sort of okay, although there are lots of edge cases that it doesn't handle correctly.