Skip to main content

Insecure service configuration - SMTP

Need​

Secure configuration of SMTP service

Context​

  • Usage of Python 3 for writing and executing Python code
  • Usage of smtplib for sending emails in Node.js

Description​

Non compliant code​

import smtplib

def send_email(from_addr, to_addr_list, cc_addr_list,
               subject, message,
               smtpserver='localhost', smtp_port=25, username='', password='',
               isTls=True):
    header  = 'From: %s\\n' % from_addr
    header += 'To: %s\\n' % ','.join(to_addr_list)
    header += 'Cc: %s\\n' % ','.join(cc_addr_list)
    header += 'Subject: %s\\n\\n' % subject
    message = header + message

    server = smtplib.SMTP(smtpserver, smtp_port)
    server.starttls()
    server.login(username,password)
    problems = server.sendmail(from_addr, to_addr_list, message)
    server.quit()

# Send an email
send_email('[email protected]', ['[email protected]'], ['[email protected]'],
           'Test Subject', 'Test Message',
           smtpserver='smtp.example.com', smtp_port=25, username='user', password='password')

The above Python code uses the smtplib library to send an email from the specified 'from' address to the 'to' and 'cc' address lists with a defined subject and message. The SMTP server and port are defined in the send_email function parameters, with the SMTP server defaulting to 'localhost' and the port defaulting to 25.

The vulnerability lies in the open SMTP port (25), which is used to send the email. This port is commonly used for mail delivery, but if not properly secured, it can be exploited by attackers to send emails using the web server. This could lead to a number of potential issues, including spamming, phishing, and server reputation damage.

Furthermore, the use of plain text for the username and password parameters in the send_email function could potentially expose these sensitive details if the communication is intercepted. This is another security concern that should be addressed.

Finally, the starttls() method is called to upgrade the insecure connection to a secure one, which encrypts the rest of the communication with the SMTP server. However, if the initial connection is intercepted before the starttls() method is called, an attacker could potentially exploit this to perform a man-in-the-middle attack.

In conclusion, this code is vulnerable due to the open SMTP port and the potential exposure of sensitive details in the send_email function. Proper security measures should be implemented to address these issues.

Steps​

  • Close the open SMTP port 25 on the server. This can be done by configuring the server's firewall settings.
  • Configure the SMTP server to require authentication before sending emails. This can prevent unauthorized users from sending emails using the server.
  • Use a secure connection (SSL/TLS) when sending emails. This can prevent attackers from intercepting the emails.
  • Consider using a higher port number for SMTP, such as 587 or 465, which are often used for secure email submission.
  • Regularly update and patch the SMTP server software to ensure that it is protected against known vulnerabilities.

Compliant code​

import smtplib
from smtplib import SMTP_SSL as SMTP
from email.mime.text import MIMEText

def send_email(from_addr, to_addr_list, cc_addr_list,
               subject, message,
               smtpserver='localhost', smtp_port=587, username='', password='',
               isTls=True):
    header  = 'From: %s\\n' % from_addr
    header += 'To: %s\\n' % ','.join(to_addr_list)
    header += 'Cc: %s\\n' % ','.join(cc_addr_list)
    header += 'Subject: %s\\n\\n' % subject
    message = header + message

    msg = MIMEText(message)
    msg['Subject']= subject
    msg['From']   = from_addr

    server = SMTP(smtpserver)
    server.login(username,password)
    server.sendmail(from_addr, to_addr_list, msg.as_string())
    server.quit()

# Send an email
send_email('[email protected]', ['[email protected]'], ['[email protected]'],
           'Test Subject', 'Test Message',
           smtpserver='smtp.example.com', smtp_port=587, username='user', password='password')

The updated code now uses a secure SMTP connection (SMTP_SSL) and port 587, which is often used for secure email submission. The SMTP server now requires authentication before sending emails, which can prevent unauthorized users from sending emails using the server.

The smtplib.SMTP is replaced with smtplib.SMTP_SSL to use a secure SSL connection when sending emails. This can prevent attackers from intercepting the emails.

The server.sendmail method is updated to send the msg object, which is an instance of MIMEText. This object represents the email as a MIME text object, which can include the email headers (From, To, Cc, Subject) and the email body.

The server.login method is used to log in to the SMTP server using the provided username and password. This is done before sending the email, which ensures that only authorized users can send emails.

The server.quit method is used to terminate the SMTP session after the email is sent. This is a good practice to free up system resources and to ensure that the SMTP server is not left open to potential abuse.

References​

Last updated on