3

I know that SMTP is inherently vulnerable to a lot of issues and if not properly configured, an SMTP server can be used to relay emails which originate from and destined to third-party domains.

What I understand from open mail relay is unauthenticated relay of emails. Correct me if I am wrong. Is there any good reason why unauthenticated relay should be allowed inside a corporate network?

Is it considered vulnerable if the following POC results in an email in my inbox?

telnet internalmailserver.mydomain.com 25
220 Ironportblabla.mydomain.com ESMTP
HELO
250 Ironportblabla.mydomain.com
MAIL FROM:[email protected]
250 sender <[email protected]> ok
RCPT TO:[email protected]
250 recipient <[email protected]> ok
DATA
354 go ahead
TEST
.
250 ok: Message 123456 accepted
  1. The above method can be used by an internal adversary to spoof and send emails to any internal employee as anyone else. Isn't this vulnerable?
  2. Is there any justified acceptable reason for allowing internal-internal and external-internal relay in internal mail servers?
  3. Would stopping this affect the normal functioning of corporate email?

1 Answer 1

5

The above method can be used by an internal adversary to spoof and send emails to any internal employee as anyone else. Isn't this vulnerable?

Yes. There is a university of applied sciences in my neighborhood that had such a mail server that allowed any user to use any email address from their own domains. Someone abused it to send around personalized but automated love letters. It was hilarious. The IT department, instead of being in shame after having been pointed to that vulnerability multiple times, went after the person. It was hilarious.

Is there any justified acceptable reason for allowing internal-internal and external-internal relay in internal mail servers?

You often have an outgoing mail server that your internal mail server contacts for all mails that it cannot deliver locally. These two are often running on the same machine, and it's acceptable to open the mail server port only locally to allow the internal, and only the internal mail server, to directly talk to the outgoing server. The internal server then has the duty of making sure only authorized users can send mail from addresses that belong to them.

Would stopping this affect the normal functioning of corporate email?

No, because this isn't normal.

2
  • Thank you for the quick reply. Just wanted to confirm one more thing. How do you mitigate this issue? Is it done by mandating auth for all the mail sending actions?
    – hax
    Jan 17, 2017 at 21:41
  • @hax Yes. That sounds like a very reasonable, if not self-evidently necessary, option Jan 17, 2017 at 21:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .