mirror of
https://blitiri.com.ar/repos/chasquid
synced 2026-10-28 15:02:28 +00:00
Alberto Bertogli
61792e3bb4
Domains in addresses had very lax validation, which allowed them to include characters like "/". That could be exploited to trigger a daemon panic: a MAIL FROM "x@evil/foo" could be accepted and, on failed delivery, a DSN queued. Attempting to deliver the DSN would cause an MTA-STS cache lookup, which would panic because the domain includes a "/" and crash the server. Because the DSN would be queued, the server would crash again on restarts, and only self-recover after give_up_send_after (20h by default). To fix this, we now explicitly validate the domain when normalizing it, make MTA-STS cache not panic on invalid domains, and also make the SMTP courier fail permanently on invalid domains. Thanks to John JEAN <john@wargan.com> for finding and reporting this problem. The detailed report can be found in https://johnjean.io/advisories/chasquid-unauthenticated-remote-dos/.
48 lines
1.1 KiB
Plaintext
48 lines
1.1 KiB
Plaintext
|
|
c tcp_connect localhost:1025
|
|
|
|
c <~ 220
|
|
c -> HELO localhost
|
|
c <~ 250
|
|
c -> MAIL LALA: <>
|
|
c <- 500 5.5.2 Unknown command
|
|
|
|
c -> MAIL FROM:
|
|
c <~ 500
|
|
|
|
# Reconnect to avoid getting rejected due to too many errors.
|
|
c close
|
|
c tcp_connect localhost:1025
|
|
c <~ 220
|
|
c -> HELO localhost
|
|
c <~ 250
|
|
|
|
c -> MAIL FROM:<pepe>
|
|
c <~ 501
|
|
|
|
c -> MAIL FROM:<a@xn--->
|
|
c <- 501 5.1.8 Malformed sender domain
|
|
|
|
# Reconnect to avoid getting rejected due to too many errors.
|
|
c close
|
|
c tcp_connect localhost:1025
|
|
c <~ 220
|
|
c -> HELO localhost
|
|
c <~ 250
|
|
|
|
c -> MAIL FROM:<a@b/c>
|
|
c <- 501 5.1.8 Malformed sender domain
|
|
|
|
c -> MAIL FROM:<a@[1.2.3.4]>
|
|
c <- 501 5.1.8 Malformed sender domain
|
|
|
|
# Reconnect to avoid getting rejected due to too many errors.
|
|
c close
|
|
c tcp_connect localhost:1025
|
|
c <~ 220
|
|
c -> HELO localhost
|
|
c <~ 250
|
|
|
|
c -> MAIL FROM:<aaaa5aaaaXaaaa5aaaaXaaaa5aaaaXaaaa5aaaaXaaaa5aaaaXaaaa5aaaaXaaaa5aaaaXaaaa5aaaaXaaaa5aaaaXaaaa5aaaaXaaaa5aaaaXaaaa5aaaaXaaaa5aaaaXaaaa5aaaaXaaaa5aaaaX@bbbb5bbbbXbbbb5bbbbXbbbb5bbbbXbbbb5bbbbXbbbb5bbbbXbbbb5bbbbXbbbb5bbbbXbbbb5bbbbXbbbb5bbbbXbbbb5bbbbXbbbb5bbbbXbbbb5bbbbXbbbb5bbbbXbbbb5bbbbXbbbb5bbbbX>
|
|
c <- 501 5.1.7 Sender address too long
|