3

Is it possible for a valid email address (something that would work if used send to gmail, for varying definitions of valid (the email would be received not the exploit)) to contain javascript that could be exploited if rendered and the output is not sanitized (properly encoded)? if so please provide an example.

  • 1
    Valid emails cannot include javascript code, but your application input field might be vulnerable to injected code. – schroeder Dec 1 '15 at 19:32
  • @schroeder right, I'm just trying to figure out if there's a way to craft an email address that would send, but could be used for an exploit if rendered. Just pen testing our app, about to log some other vulnerabilities I've found. – xenoterracide Dec 1 '15 at 19:38
  • it's not really a problem of inputs but outputs, I've come to an enlightenment, sanitizing inputs isn't really the goal. You want to sanitize outputs, SQL injection is about sanitizing what is sent to the SQL server. Javascript Injection is about sanitizing what is sent to the browser. I want to craft a malicious input to see if any one of 50 outputs does not sanitize it properly. (no I'm not saying don't validate your inputs) – xenoterracide Dec 1 '15 at 21:03
  • you need to include this perspective in the question so that we understand what you are trying to achieve – schroeder Dec 1 '15 at 22:10
5

I would say that theoretically (and practically, depending on your sanitation function), yes, the local part of an email can be used in XSS attacks.

The problem is that email addresses are complex and may include a number of special characters. Additionally, email addresses offer features such as comments and quoted strings, which allow even more special characters.

XSS in Local Part of Email Address

[I'm using the informational rfc3696, because it's a lot nicer to read than the official rfcs.]

The exact rule is that any ASCII character, including control characters, may appear quoted, or in a quoted string.

So a valid email address would be:

"<script>alert(1)</script>"@example.com

You can test its validity here. This is obviously not secure.

Further Possibilities

Even without quoted strings, an attacker can at least get close:

Without quotes, local-parts may consist of any combination of alphabetic characters, digits, or any of the special characters ! # $ % & ' * + - / = ? ^ _ ` . { | } ~

This is already enough to enter a javascript context, eg:

<a href='mailto:USER_EMAIL'>email me</a>

via:

foo'onclick='alert'foo='@example.com

The problem here is that ( is not allowed, but I would not be comfortable printing this to the enduser unencoded. At the very least, a user could change the style: foo'style='color:red'title='imImportant'@example.com.

You can also place the payload inside a comment of the local part, so possible restrictions of your email provider do not apply, eg: ("<script>alert</script>")me@gmail.com, where me@gmail.com is your email address (here, the same rules as above apply - < and > can only be inside quoted strings; additionally, you cannot have ( and ), even in quoted strings).

And this is just about the local part. The domain part gives an attacker additional attack vectors.

Proper Defense

This is why XSS prevention should not be about filtering, but proper encoding. All dangerous characters (in most contexts - but not all - these are at least ', ", <, and >) should be HTML encoded when send to a user, no matter what filter was applied beforehand.

  • can you combine the quoted with the unquoted? wondering if you can write something like xenoterracide+"<script>alert(1)</script>"@gmail.com – xenoterracide Dec 1 '15 at 23:54
  • @xenoterracide not like that. What is allowed are local parts that contain quoted and unquoted parts separated by periods, so eg xenoterracide."<script>alert(1)</script>"@gmail.com. Comments are also allowed with quoted strings, eg: (xenoterracide)"<script>alert(1)</script>"@gmail.com. – tim Dec 2 '15 at 9:09
0

Further to Tim's excellent answer, Gmail implement a Content Security Policy to prevent any script that manages to bypass their filters from rendering in supported browsers.

So yes, while an email address can contain tags "<script>alert('foo')</script>"@example.com I would be surprised if Google were not correctly encoding it, and as said they have the CSP to protect users if they were not. Having said that, there was a recent bug in the Gmail app in Android which allowed from addresses to look like they were spoofed at first glance.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.