> # Description: Spammers can hide behind 'Email a friend/article' scripts.
These are just an instance of the more general form hijacking attacks. I've
seen several attempts to abuse feedback forms and similar through a simple
scheme - each form field was filled with
"To: <someaddr>\nFrom: <someaddr>\n"
Form scripts that do not check for newlines within the fields are vulnerable
to those attacks in general, for example in perl pseudocode:
open(SENDMAIL, "|/usr/sbin/sendmail -someflags")
or print "Some Error: $!\n";
print SENDMAIL "From: $formfield_from\n";
print SENDMAIL "To: $recipient-taken-from-some-config\n";
print SENDMAIL "Subject: Foo Bar '$formfield_subject'\n";
print SENDMAIL "\nMail content\n";
close(SENDMAIL);
If $formfield_subject contains the above line with additional To:s, it
depends on the MTA whether he parses the additional headers and sends
them along.
Around end of march/beginning of april 2004 I've seen a number of attempts
to abuse such scripts. It look like a systematic approach and not some
random guesses.
-- Matthias
--
Matthias' Braindump http://matthias.leisi.net/
