I know that SMTP is inherently vulnerable to a lot of issues and if not properly configured, an SMTP server can be used to relay emails which originate from and destined to third-party domains.
What I understand from open mail relay is unauthenticated relay of emails. Correct me if I am wrong. Is there any good reason why unauthenticated relay should be allowed inside a corporate network?
Is it considered vulnerable if the following POC results in an email in my inbox?
telnet internalmailserver.mydomain.com 25
220 Ironportblabla.mydomain.com ESMTP
HELO
250 Ironportblabla.mydomain.com
MAIL FROM:[email protected]
250 sender <[email protected]> ok
RCPT TO:[email protected]
250 recipient <[email protected]> ok
DATA
354 go ahead
TEST
.
250 ok: Message 123456 accepted
- The above method can be used by an internal adversary to spoof and send emails to any internal employee as anyone else. Isn't this vulnerable?
- Is there any justified acceptable reason for allowing internal-internal and external-internal relay in internal mail servers?
- Would stopping this affect the normal functioning of corporate email?