[
https://issues.apache.org/jira/browse/JAMES-2144?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Antoine Duprat closed JAMES-2144.
---------------------------------
> As an attacker I can overwrite JMAP attachment ContentType
> ----------------------------------------------------------
>
> Key: JAMES-2144
> URL: https://issues.apache.org/jira/browse/JAMES-2144
> Project: James Server
> Issue Type: Bug
> Components: JMAP
> Reporter: Antoine Duprat
> Assignee: Antoine Duprat
>
> Action: As an attacker I can overwrite JMAP attachment ContentType in anyone
> mailbox.
> Access required:
> None (sending a mail)
> Exact content of the attachment whose ContentType to be replaced
> Cause of the vulnerability: The content-type is not taken into account in the
> AttachmentId computation. Only content is. Hence sending the same message two
> time with different content type will result in a single attachment being
> stored, hence a content-type overwrite.
> Exemple of exploit:
> usera sends a PDF to various persons.
> I receive it.
> I send the same PDF to myself, but with Content-Type text/plain.
> The Content-Type of the attachment is now changed for each persons.
> Fixing it:
> We will change the AttachmentId computation algorithm to take into account
> content-type. Different content type will mean different attachmentId and
> thus no content-type overwrite.
--
This message was sent by Atlassian JIRA
(v6.4.14#64029)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
