Avoiding Backend Exploitation of Mail Forms Max Kessler, LPIC-1

OWASP Top 10 List ● #1 Unvalidated user input ● #2 Broken access control (sort of) ● #6 Injection flaws

How do mail forms work? ● A user types in their name, address and a message. ● Their data are sent to the web server in an HTTP request. ● The server runs a script that formats the text for consumption by a mail server, then feeds it to the mail server.

User input on the command line Exploit 1: insert semicolon/ampersand The command should be: /bin/sh /usr/sbin/sendmail -f \ The command is: /bin/sh /usr/sbin/sendmail -f \ xterm -display :0&echo \

Replay with control characters Exploit 2: insert control characters address should be: address is: To:

Starting a new message Exploit 3: using '.' to start a new message SMTP servers allow multiple messages to be sent through a single connection. A new message is started by putting a '.' on a line by itself.