One of the early web application vulnerabilities I remember was CVE-2000-0411 [CVE]. This was a simple vulnerability in a CGI-bin script used to send e-mail. The vulnerability was pretty straightforward: Adding additional parameters to the URL leaked environment variables. Other vulnerabilities allowed setting the "To" address and were heavily abused by spammers. And if parameters were passed directly to the sendmail binary, similar vulnerabilities could allow arbitrary code execution.
Today, I noticed a slight resurgence in scans targeting e-mail scripts on our honeypots. Today, there are numerous scripts like the old "formail" scripts, and it is hard to link a specific vulnerability to any of these scans. But my main suspect is spammers looking for webforms that allow setting arbitrary "To" headers. The URLs I am seeing:
"/sendmail.php"
"/test-mail.php"
"/testemail.php"
"/config/mail_config.php"
"/mail_config.php"
"/email-test.php"
"/mailtest.php"
In particular, the "Test" part of the filename suggests that the attacker is not looking for production scripts, but for test scripts left behind during development. This, along with the requests for credential/secret files that top our "Leaderboard," points to a more fundamental issue: Code hygiene. Do not leave behind development artifacts that should never have reached a live website.
For example, some excerpts from a random "mailtest.php" script that came back in a Google search [mailtest]:
<?php
/*
DONT FORGET TO DELETE THIS SCRIPT WHEN FINISHED!
*/
$server = array(
'HTTP_HOST', 'SERVER_NAME', 'SERVER_ADDR', 'SERVER_PORT',
'SERVER_ADMIN', 'SERVER_SIGNATURE', 'SERVER_SOFTWARE',
'REMOTE_ADDR', 'DOCUMENT_ROOT', 'REQUEST_URI',
'SCRIPT_NAME', 'SCRIPT_FILENAME',
);
$to = ( isset( $_GET['email'] ) ? $_GET['email'] : FALSE );
$subject = 'Mail Test Successful for ' . $_SERVER['HTTP_HOST'];
$message = '';
??????? foreach ( $server as $s )
{
$message .= sprintf( '%s: %s', $s, $_SERVER[$s] ) . PHP_EOL;
};
$success = mail( $to, $subject, $message, $headers );
The comment at the top says it all: This is not meant for production use, and even on a development site, it should likely be deployed only briefly for debugging. The script takes any "To" address from the "email" GET parameter and exfiltrates/displays part of the server configuration. It can be useful to scan your own hosts for some of these URLs as an additional control, but you really want to catch these issues during application deployment.
[CVE] https://nvd.nist.gov/vuln/detail/cve-2000-0411
[mailtest] https://gist.github.com/Porrapat/60ed7411d933122fc481
--
Johannes B. Ullrich, Ph.D. , Dean of Research, SANS.edu
Twitter|