Email Server Connection Bypass in Appsmith

Compliance Impact

The provided information does not specify how this vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in Appsmith versions prior to 1.99 in the POST /api/v1/admin/send-test-email endpoint. The endpoint accepts attacker-controlled smtpHost and smtpPort values and establishes a raw JavaMail TCP connection without validating the IP address. This bypasses the WebClientUtils.IP_CHECK_FILTER, which only applies to Spring WebClient HTTP requests, not raw TCP connections.

Additionally, the raw error message from MailException.getMessage() is returned directly in the API error response. This behavior allows attackers to perform error-based internal port scanning and service banner enumeration.

The vulnerability is fixed in Appsmith version 1.99.

Useful 0 Not Useful 0

Impact Analysis

An attacker can exploit this vulnerability to bypass IP validation controls and establish unauthorized TCP connections to internal services using the smtpHost and smtpPort parameters.

By receiving raw error messages, the attacker can perform internal port scanning and enumerate service banners, potentially revealing sensitive information about internal network services.

This can lead to increased risk of further attacks targeting internal infrastructure that is otherwise protected by IP filtering.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is fixed in Appsmith version 1.99. Immediate mitigation involves upgrading your Appsmith installation to version 1.99 or later.

Since the vulnerability involves the POST /api/v1/admin/send-test-email endpoint accepting attacker-controlled smtpHost and smtpPort values without IP validation, restricting access to this endpoint and monitoring for suspicious usage may help reduce risk until the upgrade is applied.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing the POST /api/v1/admin/send-test-email endpoint with controlled smtpHost and smtpPort values to observe if raw JavaMail TCP connections are established without IP validation and if raw MailException messages are returned in the API error responses.

To detect exploitation or presence of this vulnerability, you can attempt to send crafted requests to the endpoint and analyze the responses for error messages that reveal internal port scanning or service banners.

• Use curl or similar tools to send POST requests with different smtpHost and smtpPort values to the vulnerable endpoint, for example:
• curl -X POST https://<appsmith-server>/api/v1/admin/send-test-email -H 'Content-Type: application/json' -d '{"smtpHost":"127.0.0.1","smtpPort":6379}'
• Check the response for raw error messages indicating connection attempts to internal services like Redis (port 6379) or others.
• Monitor network traffic for outgoing TCP connections initiated by the Appsmith server to the specified smtpHost and smtpPort values.

Useful 0 Not Useful 0