RE: [PHP] Re: CRLF Injection in mail()

> -----Original Message----- > From: Richard Lynch [mailto:rich@phpbootcamp.com] > Sent: Saturday, July 20, 2002 3:24 AM > To: php-general@lists.php.net > Subject: [PHP] Re: CRLF Injection in mail() > > >Maybe I'm behind the times, but I just found out about this one today. > >Basically if a user can take your form that sends an email, and send a > >value like "This is my subject\nBcc: myemail@myisp.com" for the subject, > >then they will get Bcc'd on every email your script later sends. One > > NO! They'll get a Bcc: on the *ONE* email they sent with your FORM. It depends on your form. If you have a "contact the admins" form, then they can find out your email. Or say you are running an AA help group and you provide a way for people to email each other through the web. Someone can type in a message and then your PHP script send out a message to each of the members, but the message is from your web site, not the person, so their identities are hidden, for privacy reasons. Now if I put in a contaminated Subject, I can get CC:d on EVERY email that the script sends out at that time. I can find out everyone's email address. How are you protecting the privacy of your users? > Since they *SENT* the email, that does not seem like much of an issue to > me. It's not the content they would be after, it would be finding out the email addresses of the recipients. > Or are you *STORING* the Subject:, and then re-using *THEIR* Subject for > other emails? Yikes. Why in the world would you do that? If you're > letting > them decide what the subject is in emails sent out by somebody else, > that's > just wrong in the first place. It would just work each time they filled out the form. > >method to use is to download your form (Save As), modify the usual > >'text' box into a <textarea> and put in a value like that given above. > >Note that it has to be an actual line feed (like in a textarea), not > >just a \n typed in (that'll get escaped by magic_quotes, hopefully). > > If they want to be really kosher, they need \r\n, not just \n in there. > > Read the RFC's. OK. > >Where this comes into play as "bad" is when you're trying to hide email > >addresses, and now the user can Bcc: themselves on everything sent out > >and find out the email address of everyone. > > No, no, no. Unless you're foolish enough to let them upload their altered > HTML to your web-site, or be sending out emails from other people using > *THEIR* subject as data. But most forms do let people choose their own subject. And I don't have to upload the code anywhere, just provide a full http:// address to your form processing page. I can spoof HTTP_REFERRER if you are checking for that. Now if your authenticating or using a session, it may be harder. > >Why isn't, or is this, considered a bug? Is there any valid reason for > >PHP not to check for this itself and say that Subject (and whatever > >other fields are vulnerable) can only contain a subject header and > >that's it? > > > >What do you think? > > If you are worried about it, your PHP script can simply check the subject > before you send the email. > > <?php > $subject = explode("\n", $subject); > $subject = trim($subject[0]); > mail(...,$subject,...); > ?> Many ways to fix it, once you are aware of it. > It's certainly not a PHP "bug" for PHP to let you put whatever you want in > your Subject, no matter how badly-designed that might be. > > It's not PHP's job to stop you from doing "stupid" things :-) But if you use mail($to,$subject,$message,$headers), then PHP should ONLY allow a SUBJECT: header to be set in the $subject parameter. Same thing for $to. It's not PHP stopping us from doing stupid things, it's PHP doing what it says it's going to do, only letting the value of $subject set the Subject: header and that's it. This is something that 99% of the people out there aren't going to think about. Look at all the problems already with cross-site scripting. It's an easy fix, yes, once you know about it, but I think it could be better handled at the PHP core level. Is there ever a need to let someone set additional headers in the Subject part of mail()? Why allow people the change to do it and have unwanted consequences when it's easily fixed for everyone? My $0.02 :) ---John Holmes...