GHSA-458g-q4fh-mj6r

Описание

Summary

Serendipity inserts $_SERVER['HTTP_HOST'] directly into the Message-ID SMTP header without any validation beyond CRLF stripping. An attacker who can control the Host header during an email-triggering action can inject arbitrary SMTP headers into outgoing emails, enabling spam relay, BCC injection, and email spoofing.

Details

In include/functions.inc.php:548:

The existing sanitization function only blocks \r\n and URL-encoded variants:

Critically, serendipity_isResponseClean() is not even called on HTTP_HOST before embedding it into the mail headers — making this exploitable with any character that SMTP interprets as a header delimiter.

Email is triggered by actions such as:

• New comment notifications to blog owner
• Comment subscription notifications to subscribers
• Password reset emails (if configured)

PoC

Resulting malicious Message-ID header in outgoing email:

Impact

An attacker can control the domain portion of the Message-ID header in all outgoing emails sent by Serendipity (comment notifications, subscriptions). This enables:

• Identity spoofing — emails appear to originate from attacker-controlled domain
• Reply hijacking — some mail clients use Message-ID for threading, pointing replies toward attacker infrastructure
• Email reputation abuse — attacker's domain embedded in legitimate mail headers

Suggested Fix

Sanitize HTTP_HOST before embedding in mail headers, and restrict to valid hostname characters only: