Splitting the Email Atom: Exploiting Parsers to Bypass Access Controls

" summary

Shows how RFC-compliant addresses are weaponized to bypass domain checks: encoded-word and Unicode overflows let the Ruby mail library (v2.8.x, 58M+ downloads) split addresses to deliver mail to attacker domains while GitLab, GitHub and Zenesk still accept the original domain; demonstrates a live Joomla‑style (transcript: Jumla) RCE using malformed Punycode plus a NodeJS CSS exfiltrator. Includes tooling — Burp/Hackverter extensions, Turbo Intruder scripts, a Punycode fuzzer — and working demos and PoCs, so expect reproducible exploits not just theory.

AI-written summary · about

" related talks

• 40mStealing With Style: Using CSS to Exploit ProtonMail & FriendsPaul Gerste · Black Hat Asia 2023
• 50mA New Era of SSRF - Exploiting URL Parser in Trending Programming Languages!Orange Tsai, Cheng-Da Tsai · CODE BLUE 2017
• 47mLive Hacking: Breaking into Your Web AppBrian Vermeer · Heapcon 2019
• 42mModern web application bugsErlend Oftedal · NDC Sydney 2018
• 58mModern web application bugsErlend Oftedal · NDC Minnesota 2019
• 47mA New Era of SSRF - Exploiting URL Parser in Trending Programming Languages!Orange Tsai · Black Hat Asia 2018
• 55mHow hacking worksEspen Sande-Larsen · NDC Security 2023
• 01h 06mHow hacking worksEspen Sande-Larsen · NDC TechTown 2023