I know that SMTP is inherently vulnerable to a lot of issues and if not properly configured, an SMTP server can be used to relay emails which originate from and destined to third-party domains.
What I understand from open mail relay is unauthenticated relay of emails. Correct me if I am wrong. Is there any good reason why unauthenticated relay should be allowed inside a corporate network?
Is it considered vulnerable if the following POC results in an email in my inbox?
telnet internalmailserver.mydomain.com 25 220 Ironportblabla.mydomain.com ESMTP HELO 250 Ironportblabla.mydomain.com MAIL FROM:[email protected] 250 sender <[email protected]> ok RCPT TO:[email protected] 250 recipient <[email protected]> ok DATA 354 go ahead TEST . 250 ok: Message 123456 accepted
- The above method can be used by an internal adversary to spoof and send emails to any internal employee as anyone else. Isn't this vulnerable?
- Is there any justified acceptable reason for allowing internal-internal and external-internal relay in internal mail servers?
- Would stopping this affect the normal functioning of corporate email?