Proofpoint Enterprise Protection URL Rewrite Bypass Vulnerability

A vulnerability exists in Proofpoint Enterprise Protection's URL rewriting process, allowing an unauthenticated remote attacker to send emails that bypass URL protections. This flaw, which impacts the integrity of the recipient's email, arises from inadequate filtering of backslashes in URLs. The vulnerability affects all versions of 8.21, 8.20, and 8.18 prior to their respective patched releases.

Impact

Exploitation of this vulnerability allows for a URL rewrite bypass, undermining URL protections and potentially leading to malicious links being delivered via email.

Remediation

Proofpoint has released patches for this vulnerability in versions 8.18.6 patch 5113, 8.20.6 patch 5114, and 8.21.0 patch 5115. On-premises customers should upgrade to these versions. Proofpoint On-Demand customers do not need to take any action, as the fixes have already been deployed.