Re: Joomla Content Manager 1.5 Mail Fun

[Nick FitzGerald <nick () virus-l demon co uk>]

Tomm Foo wrote:

> This might be old, but I find this interesting enough that Ill share just in
> case.

Dunno if this specific one is know, but spammers (especially 419'ers) 
have been abusing these poorly implemented "Email a friend" type 
functions on web pages for quite some time...

> By accident I ran across several sites that allow you to send an email
> containing a link to whatever site you please from any sender you choose,
> all under the header of a presumably legitimate site.
>
> An example,
>
> https://www.1stprioritymortgage.com/index.php?option=com_mailto&tmpl=component&link=aHR0cHM6Ly93d3cuMXN0cHJpb3JpdHltb3J0Z2FnZS5jb20vaW5kZXgucGhwP3ZpZXc9YXJ0aWNsZSZpZD04NCUzQXNpdGUtbWFwJm9wdGlvbj1jb21fY29udGVudCZJdGVtaWQ9OTM=
>
> (found by clicking the mail button on all the article pages containing this
> software) will send the recipient you designate a link to the page you were
> viewing. However, by changing the base64 code above to a link of your own
> works as well, thus
>
> https://www.1stprioritymortgage.com/index.php?option=com_mailto&tmpl=component&link=Cmh0dHA6Ly93d3cuZXZpbGdheXNleC5jb20vdmlydXMucGhwPz1sb2wK
>
> will be sent to the recepient instead. Spoof a legitimate page and you could
> easily snag the cluesless plebe into visiting somewhere much more nasty.

Of course, that Base64-encoded string need not decode to a URL...

You can Base64 encode any message body you desire (length limits not 
tested) and stick that in as the link parameter to the URL.  The server-
side processor happily decodes that and adds that text to its own 
(quite brief in this case) message body.  As the sent messages are:

   Content-Type: text/plain

some of the cleverness that other such "Email a friend" forms have 
(quite unintentionally) allowed with HTML content are not available.

Oh, and there is an issue with "+" chars in the Base64-encoded text 
passed back to the form processor (they get turned into spaces and 
dropped, as you may expect).

A good thing this particular instance has that many others don't is 
that it tries to prevent multiple addresses being entered via the form, 
making it somewhat less spammer-friendly (though I've seen many 
instances where 419's apparently c'n'p the same stuff over and over 
into the same form, with a different Email address each time or maybe 
have automated it to do one address at a time).



Regards,

Nick FitzGerald


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/