Path Traversal in parsedmarc Forensic Reports

Executive Summary

This vulnerability exists in parsedmarc versions before 11.0.1. When forensic report sample files are generated, the output path is derived from the email subject. If the subject contains only path traversal sequences, the filename sanitization fails and produces an empty string. This causes the system to fall back to the raw unsanitized subject, writing files outside the intended samples directory. An attacker can exploit this by crafting an email subject to write a dot-prefixed file with malicious content to a parent directory of the samples output path.

Exploitation requires that file output for forensic report samples is enabled.

Useful 0 Not Useful 0

Detection Guidance

Check for unexpected files in parent directories of the samples output path with dot-prefixed names. Review forensic report sample file paths in parsedmarc logs for unusual subject-derived filenames.

Useful 0 Not Useful 0

Impact Analysis

An attacker could write malicious files to unintended directories on your system. This could lead to arbitrary code execution, data corruption, or unauthorized access if the attacker places files in sensitive locations. It may also allow bypassing security controls depending on the system configuration.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially affect compliance with standards like GDPR and HIPAA by allowing unauthorized file writes outside intended directories. Attackers could create files in unintended locations, potentially leading to data leakage or unauthorized access to sensitive forensic report data.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade parsedmarc to version 11.0.1 or later. Disable forensic report sample file output if not required. Validate and sanitize email subjects before processing.

Useful 0 Not Useful 0