Executive Summary

This vulnerability is an HTML injection issue in the "fetch links" email sent by Thinkst Applied Research Canarytokens. It allows attackers to manipulate the interface and perform Cross-Site Scripting (XSS) attacks in email clients that render HTML emails.

The root cause is that the 'memo' field included in the links email is not properly escaped, enabling injection of malicious HTML content.

Depending on the recipient's email client, which often renders HTML, attackers can inject phishing links, additional HTML elements, and images into notification emails.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing attackers to inject malicious content into notification emails you receive from Canarytokens.

• Attackers can insert phishing links that may trick you into revealing sensitive information.
• Additional HTML and images can be injected, potentially misleading or confusing recipients.

The actual impact depends on your email client's ability to render HTML and whether it strips out dangerous elements like script tags.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves HTML injection in the 'fetch links' email sent by Thinkst Applied Research Canarytokens, specifically through the 'memo' field without proper escaping.

Detection involves inspecting the content of Canarytokens notification emails for unexpected or malicious HTML elements such as injected phishing links or additional HTML content.

Since the issue is in the email content, you can search for suspicious HTML or script tags in the emails generated by Canarytokens.

• Use command-line tools like grep or ripgrep to search for suspicious HTML in email files or logs, for example: grep -i '<script' /path/to/emails/*
• Check the 'memo' field content in the emails for unescaped HTML by extracting the emails and reviewing their raw content.
• Monitor network traffic for Canarytokens email notifications and analyze the HTML content for injected elements.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to update Canarytokens to the latest patched version.

Specifically, self-hosted users should update their Docker image to sha-08c3f93d or later, as the vulnerability has been fixed in this version.

Additionally, review and sanitize any user input fields such as the 'memo' field to ensure proper escaping of HTML special characters to prevent injection.

If updating immediately is not possible, consider disabling or restricting the sending of 'fetch links' emails until the patch can be applied.

Useful 0 Not Useful 0