Description
waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to send arbitrary email by calling the anonymously mapped /callback/email endpoint. Attackers can POST caller-supplied subject, content, and recipient to EmailController.sendEmail, sending messages from the operator's SMTP account for phishing, spam, and mail quota exhaustion.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
wayn111 waynboot-mall
Default version status: unaffected
0 to ≤ 2.0.0affected
pkg:github/wayn111/waynboot-mallReferences
- https://hackmd.io/@hieuPenguinnn/waynboot-mall-unauth-callback-order-forgery-cancel-mail-relay ↗
- https://github.com/wayn111/waynboot-mall/blob/v2.0.0/waynboot-mobile-api/src/main/java/com/wayn/mobile/api/controller/callback/EmailController.java#L32-L42 ↗
- https://github.com/wayn111/waynboot-mall/blob/v2.0.0/waynboot-mobile-api/src/main/java/com/wayn/mobile/framework/config/SecurityConfig.java#L66 ↗
- https://www.vulncheck.com/advisories/waynboot-mall-through-2.0.0-missing-authentication-via-callback-email-mail-endpoint ↗