Mailgun: Public Security Disclosure

Re:Mailgun: Public Security Disclosure by elif on Tuesday July 11, 2023 @08:16AM (#36679911)

"I can spoof any email address" leads to an open relay elevated to mailgun's exit ips, presumably with authentication headers added by mailgun's dkim-enabled servers. because it is possible (and likely) that many users will have an inbound email trigger some form of outbound email.

Essentially, vulnerability reporter is saying "hey, you've created a landmine field of open relays, which hackers only have to discover to abuse" and mailgun is saying "no we haven't, our USERS have created those"

that is why this is different from 'literally anything that accepts email.'

[ Parent | on HN ]

Re:Mailgun: Public Security Disclosure by nickphx on Tuesday July 11, 2023 @11:48AM (#36682674)

Ehhh, mailgun is NOT relaying the mail.. Their MTA is accepting the message and re-publishing it via a webhook HTTP post to the mailgun user's configured webhook URL(s).

[ Parent | on HN ]

Re:Mailgun: Public Security Disclosure by elif on Wednesday July 12, 2023 @03:54PM (#36700744)

right... and if any single user's implementation has inbound mail cause outbound mail, merge variables or multiple RCPT lines will likely cause this user to be an arbitrary mail relay using that user's auth.

[ Parent | on HN ]

Re:Mailgun: Public Security Disclosure by nickphx on Thursday July 13, 2023 @01:17PM (#36712676)

Not sure how that would be the fault of mailgun or how spf/dkim validation enforcement on their end would help with poor design decisions of their clients.

[ Parent | on HN ]