T09 · Insecure Skill Coding Practices
Warning
- Location
- index.js:158
- Finding
- RFC 822 Header Injection Through Unvalidated Recipient Fields<![CDATA[ ## Vulnerability Details **File Location**: `index.js`, lines 158–164 **Vulnerability Type**: Email header injection caused by insufficient input validation **Risk Level**: Medium ### Vulnerable Code ```javascript function buildRFC822Email({ to, subject, body, cc = '', bcc = '' }) { const lines = [ `From: me`, `To: ${to}`, ]; if (cc) lines.push(`Cc: ${cc}`); if (bcc) lines.push(`Bcc: ${bcc}`); ``` ### Technical Analysis The `to`, `cc`, and `bcc` values originate from command-line arguments and are inserted directly into the RFC 822 header block. The implementation does not reject carriage-return (`\r`) or line-feed (`\n`) characters and does not parse the values as standards-compliant mailbox lists. An attacker who can influence these arguments may terminate an intended header and introduce additional RFC 822 headers. The resulting message is Base64URL-encoded and sent as a raw message through the Gmail API gateway. Whether a particular payload succeeds depends on Gmail and gateway validation, but the application must not rely solely on downstream rejection to enforce the integrity of security-sensitive message headers. ### Attack Path 1. An attacker gains control over, or influences, a value passed to `--to`, `--cc`, or `--bcc`, such as through an integrating agent, script, or application. 2. The attacker includes a CR/LF sequence followed by an additional RFC 822 header. 3. `parseArgs()` preserves the supplied characters without validation. 4. `buildRFC822Email()` interpolates the malicious value directly into the raw message header block. 5. `sendEmailViaMaton()` Base64URL-encodes the forged message and submits it to the documented Maton Gmail gateway. 6. If the downstream mail service accepts the constructed message, the injected header may alter message routing or metadata. ### Impact Assessment Successful exploitation may allow an attacker to add unintended recipients, modify message metadata, or cause the email body to ...[truncated 577 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Reject carriage-return and line-feed characters in every value used in an email header, including `to`, `cc`, `bcc`, and any future configurable headers. ```javascript function rejectHeaderInjection(value, fieldName) { if (/[\r\n]/.test(value)) { throw new Error(`${fieldName} contains prohibited newline characters`); } } ``` 2. Parse each recipient list with a maintained, standards-compliant email address or MIME library rather than treating the entire list as an opaque string. 3. Validate each parsed mailbox and reject malformed addresses, empty entries, comments, and unsupported address syntax according to the application's requirements. 4. Prefer a maintained MIME message-generation library over manual RFC 822 string concatenation. 5. Add regression tests covering CRLF payloads in `--to`, `--cc`, and `--bcc`, and verify that malformed input is rejected before any network request occurs. 6. Preserve least privilege by continuing to access only the explicitly supplied body file and the required `MATON_API_KEY`, and continue restricting delivery to the documented HTTPS gateway. ]]>