Unpacking SMTP Smuggling Vulnerabilities

Kicking off 2024 with a longer episode as we talk about some auditing desktop applications (in the context of some bad reports to Edge). Then we've got a couple fun issues with a client-side path traversal, and a information disclosure due to a HTTP 307 redirect. A bunch of issues in PandoraFSM, and finally some research about parser differentials in SMTP leading to SMTP smuggling (for effective email spoofing).

Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/233.html

[00:00:00] Introduction

[00:10:25] Browser Security Bugs that Aren’t - #1: Local Attacks

[00:22:10] The power of Client-Side Path Traversal: How I found and escalated 2 bugs through “../”

[00:32:30] instipod DuoUniversalKeycloakAuthenticator challenge information disclosure vulnerability

[00:38:25] Technical Advisory – Multiple Vulnerabilities in PandoraFMS Enterprise

[00:45:07] SMTP Smuggling - Spoofing E-Mails Worldwide

[01:16:20] Catching OpenSSL misuse using CodeQL

The DAY[0] Podcast episodes are streamed live on Twitch twice a week:

-- Mondays at 3:00pm Eastern (Boston) we focus on web and more bug bounty style vulnerabilities

-- Tuesdays at 7:00pm Eastern (Boston) we focus on lower-level vulnerabilities and exploits.

We are also available on the usual podcast platforms:

-- Apple Podcasts: https://podcasts.apple.com/us/podcast/id1484046063

-- Spotify: https://open.spotify.com/show/4NKCxk8aPEuEFuHsEQ9Tdt

-- Google Podcasts: https://www.google.com/podcasts?feed=aHR0cHM6Ly9hbmNob3IuZm0vcy9hMTIxYTI0L3BvZGNhc3QvcnNz

-- Other audio platforms can be found at https://anchor.fm/dayzerosec

You can also join our discord: https://discord.gg/daTxTK9