Let me prefix this by saying I am aware of how HTML e-mails can implement trackers and other malicious content, however this question is quite specific.
Consider a service where a company can register its users, and on certain events, an e-mail is sent to the user(s) of that company. Those e-mails should be fully customizable, for example by allowing the company-admin to embed their own HTML content. Notably, those e-mails will only be sent to users of that company, and no one else.
Now on to my questions:
- Is it possible to exploit a weakness in an templating engine (in this case, Mako), that could lead to a security issue? I imagine that in this case the string gets put into the template, and some recursive template resolve shenanigans happens that inserts restricted data into the HTML String. However all I can find is potentially malicious HTML issues (that does not concern us since this email gets sent to the specific customers only), not malicious Mako-Content issues.
- The HTML e-mail gets created on our backend, but since they only get rendered in the email vendor, there should be no unrestricted access to any of our internal assets, since the references wouldn't be resolvable, correct?
- Based on #2, I don't think this is the case, but is there an attack vector for DOS or stability by user inserted HTML for our service?