Executive brief
MailDev is a popular email testing application used by developers to locally test email functionality during development. A critical vulnerability allows attackers to execute arbitrary code on the server by sending a specially crafted email with a malicious Content-ID header. An attacker can completely take over the server and compromise any data it processes.
Technical details
The vulnerability exists in MailDev versions 2.0.0-beta1 through 2.1.0 in the mailserver.js file's email attachment handling logic. It is caused by insufficient validation of the Content-ID header in email attachments, which allows path traversal and arbitrary file write. An attacker can send a crafted email to port 1025 (the SMTP listener) with a malicious Content-ID value to write arbitrary code into the routes.js file, leading to remote code execution. No authentication is required; the attack is network-accessible and requires no user interaction beyond the vulnerable application receiving the email. The vulnerability has been assigned CVSS 3.1 score of 9.8 (Critical) with CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- MailDev MailDev 2.0.0-beta1 through 2.1.0
Timeline
- 2024-04-05: disclosed: GitHub advisory published
- 2024-04-05: advisory: CVE-2024-27448 assigned