NYCPHP Meetup

[csnyder]

On 9/12/05, Daniel Convissor <danielc at analysisandsolutions.com> wrote:
> Hi Billy:
> 
> On Mon, Sep 12, 2005 at 02:36:19PM -0400, Billy Reisinger wrote:
> > In fact, the attacker can stop a mail message in the
> > middle of the message body and begin an entirely new message!  For a
> > more thorough (and cogent) explanation of this vulnerability, head on
> > over to http://securephp.damonkohler.com/index.php/Email_Injection .
> 
> Huh?!  Insert headers in the middle of the message body?!  That doesn't
> make sense to me.  I believe you're misinterpreting the article you
> mention.  Perhaps I misunderstand things, but the way I see it, I can
> write "Content-Type: <whatever>" in the middle of message until my fingers
> fall off and it won't have any impact.  The problem is inserting that into
> the headers.
> 

The article is dangerously ambiguous on this point, but I think you're
right on here, Dan. In order to insert new MIME parts into the message
body, you need to be able to set the boundary marker in the headers.

So the message body itself is safe, provided your headers are properly
sanitized.