#PT12068_3 - Content Spoofing Via Emails

Server-Side Injection > Content Spoofing > Email Hyperlink Injection Based on Email Provider

Proof of Concept

1. Login into admin account on https://pentest.beta.nuxeocloud.com

1. Create a file and go to permissions tab. Eg. https://pentest.beta.nuxeocloud.com/nuxeo/ui/#!/browse/default-domain/sections/test.html?p=permissions

1. Now, share the file with external user and add "email" and message to be sent in email. Add some links or edit my file as follows:

1. This triggers an email and link in the email is rendered.

Suggested Fix

Always ensure that email contents cannot be tampered with. Limit what the user can insert into the email by filtering special characters and limiting the amount of characters that can be inserted. Filter out any URLs as they are often rendered as links by email providers.