Nodemailer jsonTransport File Access Bypass

Executive Summary

Nodemailer before version 8.0.9 has a flaw in its jsonTransport feature where security options disableFileAccess and disableUrlAccess are not enforced during message normalization. Attackers can exploit this by providing malicious path or href values in message fields to read local files or fetch URLs, bypassing intended access restrictions.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your system uses Nodemailer versions before 8.0.9. Run: npm list nodemailer. If the version is below 8.0.9, the system is vulnerable. Inspect applications using jsonTransport for file or URL access in message content fields.

Useful 0 Not Useful 0

Impact Analysis

If you use Nodemailer versions before 8.0.9 with jsonTransport enabled, attackers could access sensitive local files on your system or make unauthorized HTTP requests through your server by manipulating message content. This could lead to data leaks or further attacks if user-controlled inputs are processed.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements like GDPR or HIPAA by enabling unauthorized access to sensitive data (e.g., local files containing personal or health information). Failure to enforce access controls may result in data breaches, leading to legal penalties or regulatory fines.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Nodemailer to version 8.0.9 or later immediately. If upgrading is not possible, disable jsonTransport or implement additional access controls in shared.resolveContent() to enforce disableFileAccess and disableUrlAccess.

Useful 0 Not Useful 0