PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Splitting the email atom: exploiting parsers to bypass access controls

portswigger.net | research | #rce | #email-security | #unicode | #punycode | #parser-discrepancies | #access-control-bypass
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Email parser discrepancies — quoted values, Unicode overflows, encoded-word, malformed Punycode — become access control bypasses and RCE, with cases against GitHub, Zendesk, GitLab and Joomla.
Published
Collected

Related coverage

research · portswigger.net
CSS:the bomb inside your inbox
PortSwigger breaks webmail CSS sanitizers to cross trust boundaries, exfiltrate tokens, control AI browsers by email and steal passwords, with attacks spanning Yahoo, Fastmail, ProtonMail and Gmail.
research · portswigger.net
The Fragile Lock: Novel Bypasses For SAML Authentication
Novel SAML signature-wrapping attacks — attribute pollution, namespace confusion and Void Canonicalization — achieve full authentication bypass in Ruby and PHP libraries, including GitLab Enterprise.
research · portswigger.net
Gotta cache 'em all: bending the rules of web cache exploitation
Doyhenard's research exploits URL parser discrepancies and RFC ambiguities between CDNs and origins — delimiters, normalization, static extensions — achieving arbitrary cache poisoning and deception.
research · portswigger.net
Cookie Chaos: How to bypass __Host and __Secure cookie prefixes
Unicode whitespace bypasses __Host- and __Secure- cookie prefixes: browsers treat the cookie as unrestricted, but servers such as Django and ASP.NET trim the character and honour the protected name.
research · portswigger.net
Bypassing WAFs with the phantom $Version cookie
Legacy $Version cookies downgrade parsers into RFC2109 mode, and frameworks — Flask, Django, PHP, Spring — disagree on the result. The discrepancies can be abused to smuggle attacks past WAFs.
research · portswigger.net
Bypassing character blocklists with unicode overflows
Unicode codepoint truncation turns overflow values into blocked ASCII characters — 0x4e41 % 256 yields 'A' — bypassing character blocklists; the trick now ships in ActiveScan++ and Hackvertor.
Back