Mailpit Server-Side Request Forgery Vulnerability in HTML Check API

A server-side request forgery (SSRF) vulnerability has been identified in Mailpit, an email testing tool for developers. This issue arises in versions 1.28.3 and later, prior to 1.30.0, specifically within the HTML Check API. The vulnerability allows the server to make HTTP requests to internal loopback, private, link-local, and reserved/multicast IP ranges, bypassing security measures that are supposed to block such access. The flaw can be exploited by sending an HTML email that includes a link to an external CSS file controlled by the attacker. When the email is processed, Mailpit follows the link, potentially redirecting the request to a private network resource without detection.

Impact

Exploitation of this vulnerability allows for unauthorized access to internal services and resources, including cloud metadata services, and could be used to manipulate internal applications or perform reconnaissance on networked systems.

Reproduction

The vulnerability can be reproduced by deploying Mailpit with default settings, which do not require authentication. After sending an HTML email with a link to an attacker-controlled server that redirects to an internal IP address, the vulnerability can be triggered by using the HTML Check API on the email message. This will cause Mailpit to follow the redirect and access the internal resource, demonstrating the SSRF vulnerability.

Remediation

Users are advised to upgrade to Mailpit version 1.30.0, which includes a proper fix for this vulnerability by adding the necessary IP filtering to the HTML Check API.