Scans for vulnerable email scripts resurge on honeypots
Original title: The Classics Return: Vulnerable E-Mail Scripts, (Wed, Nov 4th)
SANS ISC notes scans for old email scripts allowing arbitrary To addresses, suspecting spammers and poor code hygiene.
The SANS Internet Storm Center observed scans targeting vulnerable e-mail scripts on honeypots. These include scripts like sendmail.php and mailtest.php that allow setting arbitrary 'To' addresses and exfiltrate server configuration. The resurgence is suspected to be from spammers looking for test scripts left behind. The entry stresses the importance of code hygiene and not deploying development artifacts on live websites.
Unconfirmed: The specific vulnerability being targeted is not linked to any specific CVE beyond the old one mentioned
- Scans for URLs like /sendmail.php, /mailtest.php observed
- Old vulnerability CVE-2000-0411 allows setting To address in CGI-bin scripts
- Test scripts exfiltrate server variables via GET parameter
- Development artifacts should not reach live sites
Impact: arbitrary 'To' address in email scripts and server config exfiltration
- 1.Scan for vulnerable scripts like sendmail.php
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2000-0411 | — | — | — |
From the original article
2 min read at isc.sans.edu
One of the early web application vulnerabilities I remember was CVE-2000-0411 [CVE]. This was a simple vulnerability in a CGI-bin script used to send e-mail. The vulnerability was pretty straightforward: Adding additional parameters to the URL leaked environment variables.
isc.sans.edu
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.