Splitting the email atom: exploiting parsers to bypass access controls
Summary: PortSwigger researcher Gareth Heyes showed that email parsing discrepancies can be turned into access control bypasses and even RCE, exploiting RFC features like quoted values, escapes, comments, and encoded-word to make parsers disagree about an address's domain. He found Sendmail 8.15.2 and Postfix 3.6.4 route mail to unexpected hosts via UUCP and source-route syntax, and that the Ruby Mail gem, with over 508 million downloads, decodes UTF-7 and base64 in addresses.
Bottom line: Applications that infer an organization from an email domain are making security decisions on a value their parsing library may read differently than the mailer does - and the Mail gem alone sits behind more than 508 million downloads.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026