,
9 tweets,
4 min read
Read on Twitter
📢 Technical thread 📢
In fact, the vulnerability I found on #Tchap is a problem that comes from the Python email.utils module 😨
The parseaddr method seems very broken, you should not use it at all. Let me show you why. 1/
In fact, the vulnerability I found on #Tchap is a problem that comes from the Python email.utils module 😨
The parseaddr method seems very broken, you should not use it at all. Let me show you why. 1/
1. Open a terminal
2. python
3. import email.utils
We are ready to play! 2/
2. python
3. import email.utils
We are ready to play! 2/
"Parse address – which should be the value of some address-containing field such as To or Cc – into its constituent realname and email address parts. Returns a tuple of that information, unless the parse fails, in which case a 2-tuple of ('', '') is returned" 3/
Yesterday, this is how @Matrix was using the parseaddr method. Job done, no? 4/
What is happening if I add @presidence@elysee.fr at the end of my email address?
Sh*t, the result is still my email address 😮. This vulnerability can be useful to bypass some email restriction as we saw yesterday 5/
Sh*t, the result is still my email address 😮. This vulnerability can be useful to bypass some email restriction as we saw yesterday 5/
It's working also if you add a space between your email address and @presidence@elysee.fr 6/
But wait, what is happening if I enter something which is not an email address?
According to the doc, he is suppose to return an empty string.
WTF?! It returns my input 7/
According to the doc, he is suppose to return an empty string.
WTF?! It returns my input 7/
Clearly, this parseaddr is not doing his job...
If you use this method in your codebase, review it asap, especially if you have implemented an email restriction 8/
If you use this method in your codebase, review it asap, especially if you have implemented an email restriction 8/
As noticed by @bortzmeyer, an issue on the Python bug tracker is opened since 2018-07-19 bugs.python.org/issue34155
