T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/imap_client.py:55- Finding
Mailbox Credentials Can Be Sent to an Arbitrary IMAP Server
- Content
View full analysis
imaplib.IMAP4_SSL: """Connect to IMAP server.""" try: config = IMAP_CONFIG.get(server) if not config: # Try as custom server config = {"server": server, "port": 993, "ssl": True} if config.get("ssl", True): imap = imaplib.IMAP4_SSL(config["server"], config["port"]) else: imap = imaplib.IMAP4(config["server"], config["port"]) imap.login(email_addr, password) print(f"✓ Connected to {config['server']}") return imap ``` ```python parser.add_argument("--server", help="IMAP server (auto-detected from email if not provided)") parser.add_argument("--email", required=True, help="Email address") parser.add_argument("--password", required=True, help="Password or app token") ``` ### Technical Analysis The declared functionality supports a fixed set of providers, but `--server` accepts an arbitrary hostname. If the value is not a key in `IMAP_CONFIG`, the code treats it as a custom server and sends the supplied email address and password to it using IMAP authentication. TLS only protects credentials while in transit. It does not establish that a user-selected endpoint is an authorized mailbox provider. An attacker controlling the endpoint and its valid TLS certificate can receive the credentials legitimately transmitted by `imap.login()`. This exceeds the minimum privilege and network scope necessary for the documented fixed-provider functionality. ### Attack Path 1. An attacker convinces a user or agent to run the client with `--server attacker.example`. 2. The code does not find that string in `IMAP_CONFIG` and treats it as a custom IMAP hostname. 3. The clien ...[truncated 588 chars]- Remediation
View remediation