Bypass of mail filters through confusion of the MIME Parser

Details

The parser initially processing e-mails for further analysis was set to not cause an error on non-standard and ambiguous information in the 'Content-Type' header:

• multiple occurrences of a 'Content-Type' header

• mulitple boundary parameters for multipart messages

• backslash as part of the boundary parameter for multipart messages

• non-printable and non ASCII characters as part of the boundary parameter for multipart messages

Accepting such messages can lead to unwanted content to be delivered to a mailbox, where the mail client interprets the ambiguous information differently. This made it effectively possible to construct a mail with an unwanted attachment, passing the filter, which was then accessible to the end-user.

The issue was addressed by rejecting mails with ambiguous content, and other errors in their structure by default. The default setting can be changed with the accept-broken-mime setting in the pmg.conf configuration file to ensure compatibility with trusted systems which send out mails with ambiguous structure. If accept-broken-mime is enabled, mails which have problematic content are logged and additionally a X-Proxmox-Broken-Message header is added, which can used for matching in the rule system (through a 'Match-Field' What Object).

This issue was initially reported by Artem Danilov of Positive Technologies.

Additionally, an issue with the treatment of an empty boundary parameter was identified and fixed in the perl MIME::Tools package. We'd like to thank Dianne Skoll <[email protected]>, for reviewing the fix and cooperating with us.

Fixed in

• Proxmox Mail Gateway 8: pmg-api >= 8.2.10, libmime-tools-perl >= 5.515-1+pmg1~bpo12+1

• Proxmox Mail Gateway 9: pmg-api >= 9.0.6, libmime-tools-perl >= 5.515-1+pmg1