Executive brief
FormMail is a widely used script that allows website visitors to send email through a web form. A security flaw in early versions allows unauthorized third-party websites to use your server's resources to send emails. This can lead to your server being used for spam, potentially resulting in your organization's domain being blacklisted by email providers.
Technical details
The FormMail CGI script lacks sufficient validation of the HTTP Referer header or a restricted list of authorized recipient domains. This allows an attacker to host a form on a completely different server and point its action to a vulnerable FormMail instance on a victim's server. By doing so, the attacker can leverage the victim's mail server to send arbitrary emails to any destination. This vulnerability is a precursor to modern open-relay issues and is typically mitigated by configuring the @referers and @recipients arrays in later versions of the script.
Affected products
- Matt Wright FormMail Versions prior to 1.6
Timeline
- 1997-01-01: disclosed: Initial vulnerability disclosure and NVD publication.