Skip to content
Splitting the email atom: exploiting parsers to bypass access controls
portswigger.net | research | #rce | #email-security | #unicode | #punycode | #parser-discrepancies | #access-control-bypass
Summary
Email parser discrepancies — quoted values, Unicode overflows, encoded-word, malformed Punycode — become access control bypasses and RCE, with cases against GitHub, Zendesk, GitLab and Joomla.
- Published
- Collected