Spam Injection

In these past two weeks, three of our hosting client websites have been exploited by a new, and common security hole among Contact Forms.

The attack itself is extremely simple. Simply stick \n or \r into the “subject” or “your email” field in an email to create a new line, then bcc in the rest of your comma-delimited email addresses in. Then when you submit the form, all of those bcc’d in email addresses will recieve the message that was intended to only be recieved by the you.

What spammers are doing is exploiting the above hole, and sticking their own spam into the ‘message’ field, and sticking their database of emails into the bcc field.

What can you do to stop this stuff?

1) Image Verification
Many of these exploits are run on a reutine basis by bots. Bots can’t usually detect what’s in an image, let alone one that is written on an angle with different colors throughout the pattern of letters. Require a user enter a string of letters he would have to read off of an image to send out his message.

2) Complicated PHP Code
Here’s some complicated php code that can be used to stop this kinda thing, you will need to edit some variables to fit your form:

if (preg_match(’ /[\r\n,;\’�]/ ‘, $_POST[’email’])) {
exit(’Invalid email address’);
}
else {
//code to send the mail
}

3) mod_security
mod_security is an addon module for apache that is made for filtering out all kinds of attacks. SQL Injection, XSS, and it can even filter out this kinda attack. Just add this into your mod_security configuration:

SecFilterSelective POST_PAYLOAD "Subject\:" chain
SecFilterSelective ARG_Bcc ".*\@"
SecFilterSelective POST_PAYLOAD "Subject\:" chain
SecFilterSelective POST_PAYLOAD "\s*bcc\:"
SecFilterSelective ARGS_VALUES "\n\s*bcc\:.*\@"

4) Multi-part forms
If they have to go through 3 or 4 pages to exploit your script, this is going to lessen the likelyhood of a bot-based attack.

Many many many many many scripts are vulnerable to this attack. Take care of your websites, will ya people?