Skip to main content

Email spoofing

Need​

Implementation of DMARC records to prevent email spoofing

Context​

  • Usage of Scala for functional and object-oriented programming in the JVM environment
  • Usage of play.api.mvc for handling HTTP requests and responses in Play Framework
  • Usage of play.api.libs.json for JSON parsing and manipulation in Play Framework
  • Usage of javax.inject for dependency injection in Java applications

Description​

Non compliant code​

import play.api.mvc._
import play.api.libs.json._
import javax.inject._

class EmailController @Inject()(val controllerComponents: ControllerComponents) extends BaseController {
  def sendEmail() = Action(parse.json) { request =>
    val emailJson = request.body
    val from = (emailJson \\ "from").as[String]
    val to = (emailJson \\ "to").as[String]
    val subject = (emailJson \\ "subject").as[String]
    val body = (emailJson \\ "body").as[String]
    
    val email = Email(from, to, subject, body)
    EmailService.send(email)
    Ok("Email Sent")
  }
}

case class Email(from: String, to: String, subject: String, body: String)

object EmailService {
  def send(email: Email) {
    // Code to send email
  }
}

The above Scala code represents a basic email sending feature in a Play Framework application. The EmailController contains a sendEmail action that accepts a JSON request, extracts the from, to, subject, and body fields, and sends an email using the EmailService.

The vulnerability lies in the fact that the from field, which represents the sender's email address, is directly taken from the user submitted JSON and used to send the email. There are no checks in place to verify if the from address is legitimate or if it belongs to the domain of the application. This allows an attacker to spoof the from address, making it appear as if the email is coming from a different source, potentially leading to phishing attacks.

The absence of Domain-based Message Authentication, Reporting & Conformance (DMARC) records makes this vulnerability possible. DMARC is an email-validation system that detects and prevents email spoofing. It uses SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) to check if the incoming email is from a domain that is authorized by that domain's administrators. Without DMARC, the application is unable to verify the authenticity of the from address in the email.

Steps​

  • Implement DMARC (Domain-based Message Authentication, Reporting, and Conformance) records for the email domain.
  • Configure the email server to enforce DMARC policies.
  • Validate the email sender's identity before sending the email.
  • Implement SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) to authenticate the email sender.
  • Use a reputable email service provider that has built-in email authentication mechanisms.
  • Educate users about email spoofing and phishing attacks to prevent them from falling victim to such attacks.

Compliant code​

import play.api.mvc._
import play.api.libs.json._
import javax.inject._

class EmailController @Inject()(val controllerComponents: ControllerComponents) extends BaseController {
  def sendEmail() = Action(parse.json) { request =>
    val emailJson = request.body
    val from = (emailJson \\ "from").as[String]
    val to = (emailJson \\ "to").as[String]
    val subject = (emailJson \\ "subject").as[String]
    val body = (emailJson \\ "body").as[String]
    
    val email = Email(from, to, subject, body)
    if(EmailService.validateSender(from)) {
      EmailService.send(email)
      Ok("Email Sent")
    } else {
      BadRequest("Invalid Sender")
    }
  }
}

case class Email(from: String, to: String, subject: String, body: String)

object EmailService {
  def send(email: Email) {
    // Code to send email
  }

  def validateSender(sender: String): Boolean = {
    // Code to validate sender using DMARC, SPF and DKIM
  }
}

The updated code includes a method validateSender in the EmailService object. This method should contain the logic to validate the sender of the email using DMARC, SPF, and DKIM.

In the sendEmail method of the EmailController class, before sending the email, the sender is validated using the validateSender method. If the sender is valid, the email is sent, otherwise, a "Bad Request" response is returned with the message "Invalid Sender".

This way, the application is protected against email spoofing by validating the sender's identity before sending the email.

Please note that the actual implementation of the validateSender method depends on the specific email server and service provider you are using. You should refer to their documentation on how to implement DMARC, SPF, and DKIM.

Also, it's important to educate users about email spoofing and phishing attacks to prevent them from falling victim to such attacks.

References​

Last updated on