Interpretation Conflict Affecting org.webjars.npm:nodemailer package, versions [3.0.0,10.1.4)

org.webjars.npm:nodemailer is an Easy as cake e-mail sending from your Node.js applications

Affected versions of this package are vulnerable to Interpretation Conflict via the address parser (src/addressparser/index.ts) when processing angle-addr and group constructs. The tokenizer tracks only a single open operator and, once < or : is encountered, looks only for the closing > or ; without accounting for quoted strings, comments, or domain literals that may appear inside. A > character inside a quoted local part therefore terminates the angle-addr prematurely, so an input such as <"a@evil.com>"@good.com> is parsed as an address at evil.com rather than the RFC 5322-conformant mailbox "a@evil.com>"@good.com. Similarly, a ; inside a quoted display name or a comment prematurely closes a group, causing additional recipients to be injected into the envelope, so G: (a; <evil@evil.com>) <v@victim.com>; delivers only to evil@evil.com instead of v@victim.com.

const addressparser = require('nodemailer/lib/addressparser');
console.log(addressparser("<\"a@evil.com>\"@good.com>"));
// [ { address: '"a@evil.com', name: '@good.com>' } ]

Python's email._header_value_parser.get_address_list reads the same value as "a@evil.com>"@good.com, with no defects reported.

The envelope a message gets is built from the same parse, so sendMail({ to: "<\"a@evil.com>\"@good.com>" }) issues the RCPT TO shown above.

Note: The PoC states no specific environment, runtime version, or operating system.

• GitHub Advisory
• GitHub Commit
• GitHub Release