Exploiting Email Parser Discrepancies to Bypass Access Controls
PortSwigger researcher Gareth Heyes reveals critical security vulnerabilities stemming from inconsistencies in how web applications parse email addresses. Many systems extract domains to infer user organizations for access control decisions, but complex RFC standards allow for quoted values, comments, and escapes that create parsing discrepancies. Heyes demonstrates how attackers can exploit these differences between application parsers and mail transfer agents to bypass security controls and potentially achieve Remote Code Execution (RCE). The research highlights issues with Unicode overflows, encoded words, and malformed Punycode. Specific case studies involve major platforms like GitHub, Zendesk, GitLab, and Joomla. The article details methodologies for generating email splitting attacks and automating exploitation. Originally presented at Black Hat and DEF CON, the findings emphasize the difficulty of correctly predicting email routing even for valid addresses. To aid understanding and testing, the publication includes a free online Capture The Flag (CTF) challenge, allowing security professionals to practice these techniques. This work underscores the risks of relying on email domains for security decisions without robust, standardized parsing mechanisms.
Wire timeline
Exploiting Email Parser Discrepancies to Bypass Access Controls
PortSwigger researcher Gareth Heyes reveals critical security vulnerabilities stemming from inconsistencies in how web applications parse email addresses. Many systems extract domains to infer user organizations for access control decisions, but complex RFC standards allow for quoted values, comments, and escapes that create parsing discrepancies. Heyes demonstrates how attackers can exploit these differences between application parsers and mail transfer agents to bypass security controls and potentially achieve Remote Code Execution (RCE). The research highlights issues with Unicode overflows, encoded words, and malformed Punycode. Specific case studies involve major platforms like GitHub, Zendesk, GitLab, and Joomla. The article details methodologies for generating email splitting attacks and automating exploitation. Originally presented at Black Hat and DEF CON, the findings emphasize the difficulty of correctly predicting email routing even for valid addresses. To aid understanding and testing, the publication includes a free online Capture The Flag (CTF) challenge, allowing security professionals to practice these techniques. This work underscores the risks of relying on email domains for security decisions without robust, standardized parsing mechanisms.
PortSwigger Research