Let me prefix this by saying I am aware of how HTML e-mails can implement trackers and other malicious content, however this question is quite specific.

Consider a service where a company can register its users, and on certain events, an e-mail is sent to the user(s) of that company. Those e-mails should be fully customizable, for example by allowing the company-admin to embed their own HTML content. Notably, those e-mails will only be sent to users of that company, and no one else.

Now on to my questions:

  1. Is it possible to exploit a weakness in an templating engine (in this case, Mako), that could lead to a security issue? I imagine that in this case the string gets put into the template, and some recursive template resolve shenanigans happens that inserts restricted data into the HTML String. However all I can find is potentially malicious HTML issues (that does not concern us since this email gets sent to the specific customers only), not malicious Mako-Content issues.
  2. The HTML e-mail gets created on our backend, but since they only get rendered in the email vendor, there should be no unrestricted access to any of our internal assets, since the references wouldn't be resolvable, correct?
  3. Based on #2, I don't think this is the case, but is there an attack vector for DOS or stability by user inserted HTML for our service?
  • HTML can embed certain types of malicious content, so any template system can as well. (Though note that JS is not a usable attack surface in email.) What does "only get rendered in the email vendor" mean? Emails are rendered by their recipients' clients. If a resource is restricted to your office/VPN, viewing them from the outside will generate an error (you should test that if you're concerned). – Adam Katz Sep 28 '20 at 14:47
  • It means precisely what you say, what I mean with email vendors here is the different email clients. As HTML is reference-based by imposing links it wouldn't be possible to embed any linked content that the user couldn't access from the outside – Joe Sep 28 '20 at 15:01
  • So this is just about mitigating a potential data-exfiltration risk? The data URI scheme can directly embed content, and text/HTML content can of course be added directly. – Adam Katz Sep 28 '20 at 15:48
  • That's true, but on the backend that HTML only gets constructed and then sent as text, so those URI's wouldn't resolve to anything since the HTML never gets rendered on the server itself (as, opposed to let's say, converting HTML to an PDF and then sending that), right? – Joe Sep 28 '20 at 17:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.