Authorization Bypass in FreeMail Allows Mailbox Takeover

Executive Summary

This is an authorization bypass vulnerability in FreeMail versions before 5.3.2. An authenticated user can claim another user's existing mailbox via the POST /api/create endpoint by exploiting the assignMailboxToUser function. This allows attackers who know a victim's email address to become co-owners, gaining unauthorized access to read messages, verification codes, set forwarding rules, or delete mail.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if multiple users can claim the same mailbox by testing the POST /api/create endpoint with an existing email address. Use tools like curl to send requests and verify if the system allows unauthorized mailbox claims. Example: curl -X POST -H 'Content-Type: application/json' -d '{"email":"victim@example.com"}' https://your-freemail-instance.com/api/create

Inspect database entries for duplicate mailbox assignments in the users table. Look for rows where the same email address is linked to multiple user IDs. Query example: SELECT user_id, email FROM users WHERE email = 'victim@example.com';

Useful 0 Not Useful 0

Impact Analysis

If you use FreeMail before version 5.3.2, an attacker could access your emails, including sensitive data like verification codes or password reset links. They could also hijack your forwarding settings or delete your emails. Upgrading to version 5.3.2 or later prevents this issue.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles and HIPAA's confidentiality requirements. Organizations using affected versions may face compliance violations, legal liabilities, and reputational damage due to potential data breaches.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade FreeMail to version 5.3.2 or later immediately. The fix prevents concurrent mailbox claims and enforces ownership checks. Redeploy the application after pulling the latest code to apply the patch.

Audit existing mailboxes for duplicate ownership. Identify and unassign any mailboxes linked to multiple users to prevent unauthorized access. Use database queries to find and resolve conflicts.

Monitor for suspicious activity such as multiple users claiming the same mailbox or unauthorized changes to forwarding settings. Review logs for POST /api/create requests with existing email addresses.

Useful 0 Not Useful 0