mail.cgi: Validate email recipient

The email recipient was not correctly validated which allowed for some
stored cross-site scripting vulnerability.

Fixes: #12925 - JVN#15411362 Inquiry on vulnerability found in IPFire
Reported-by: Noriko Totsuka <vuls@jpcert.or.jp>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/html/cgi-bin/mail.cgi b/html/cgi-bin/mail.cgi
index 4ebc6b03368f0c0d8aa9306bb9c9774af7a4434f..34f52ae01539ad4dbee460673ba380e5a9244048 100644 (file)
--- a/html/cgi-bin/mail.cgi
+++ b/html/cgi-bin/mail.cgi
@@ -283,6 +283,10 @@ sub checkmailsettings {
                        $errormessage .= "$Lang::tr{'email invalid'} $Lang::tr{'email mailsender'}<br>";
                }
        }
+       # Check for a valid recipient
+       if (!&General::validemail($cgiparams{'txt_recipient'})) {
+               $errormessage .= $Lang::tr{'email recipient invalid'} . "<br>";
+       }
        return $errormessage;
 }
 

diff --git a/langs/de/cgi-bin/de.pl b/langs/de/cgi-bin/de.pl
index d3b4c8687828b0589a03c755c57ad7f175989cec..0dbc9071879a0eddca2987b10fe3a3dc588373a8 100644 (file)
--- a/langs/de/cgi-bin/de.pl
+++ b/langs/de/cgi-bin/de.pl
@@ -963,6 +963,7 @@
 'email mailrcpt' => 'E-Mail-Empfänger',
 'email mailsender' => 'E-Mail-Absender',
 'email mailuser' => 'Benutzername',
+'email recipient invalid' => 'Ungültiger Emailempfänger',
 'email server can not be empty' => 'E-Mail-Server darf nicht leer sein',
 'email settings' => 'Mailversand',
 'email subject' => 'IPFire Test-E-Mail',

diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl
index 36f97de38276370fd302083b1d15e6424e4eb02d..7de75ad3cfe9124ecf9fef45182968e683edba8c 100644 (file)
--- a/langs/en/cgi-bin/en.pl
+++ b/langs/en/cgi-bin/en.pl
@@ -1004,6 +1004,7 @@
 'email mailrcpt' => 'Mail Recipient',
 'email mailsender' => 'Mail Sender',
 'email mailuser' => 'Username',
+'email recipient invalid' => 'Invalid email recipient',
 'email server can not be empty' => 'E-mail server can not be empty',
 'email settings' => 'Mail Service',
 'email subject' => 'IPFire Test Mail',