It has come to our attention that there is a nasty worm floating around that is compromising many PHP forms.
THE PROBLEM
The problem is that a worm is attacking forms that allow mail headers to entered on forms and then passed to the "mail" function without correct validation.
The most common cause of this is where the "From:" or other header lines are not checked.
An example:
PHP Code:
$headers = 'From: ' . $_POST['username'] . '<'. $_POST['usermail'] . '>';
mail($to, $subject, $message, $headers);
All the worm needs to do is manipulate the "username" to read:
And the mail will be bcc'd to plenty of others. It can further manipulate the headers to include MIME attachments and, basically, anything it likes.
*******************
THE SYMPTOMS
The current worm uses the domain name as a spoofed "from" e-mail address. At also attacks several fields in one go, you commonly you see a "MIME" header inside the mail.
Snippet of actual mail received (where domain.com is the domain where the form resides):
Quote:
> The following details were filled in on the form -
> Name: wlqo@domain.com
> Address: wlqo@domain.com
> Content-Type: multipart/mixed;
boundary="===============1475260401=="
> MIME-Version: 1.0
> Subject: 9b94e8d5
> To: wlqo@domain.com
> bcc: jrubin3546@aol.com
> From: wlqo@domain.com
>
> This is a multi-part message in MIME format.
>
> --===============1475260401==
> Content-Type: text/plain; charset="us-ascii"
> MIME-Version: 1.0
> Content-Transfer-Encoding: 7bit
>
> qaetdqmst
> --===============1475260401==--
> wlqo@domain.com
> wlqo@domain.com
|
***********************************
THE PRIORITY FIX
Check anything that is passed as a header and remove \n and \r charcaters from user inputted data.
This can most easily be achieved by (in the above example):
PHP Code:
ereg_replace(array("\n","\r"),'',$from)
Anything passed to the header is at risk - validate the e-mail address, username and, if sending HTML e-mail, practically everything!
NOTE: the double quotes are imporatant.
***********************************
A SUGGESTED ADDITION
It is also suggested that you add validation that the user name does not contain your own domain name or "\n" or "\r". The above fix (which is the important one) will still send an e-mail - just not maliciously as it goes to a non-existant address. Adding code validation will prevent the mail from actually being sent.
Linear Mode
