Mailpit Path Traversal Vulnerability Leading to Arbitrary File Write

A path traversal vulnerability allowing arbitrary file writes has been identified in Mailpit versions prior to 1.30.0. The issue arises in the 'mailpit dump --http <base-url> <out-dir>' sub-command, which downloads messages from a remote Mailpit instance and saves them as .eml files in a user-specified directory. The vulnerability is exploited by a malicious HTTP server that impersonates Mailpit, manipulating the message ID to traverse directories and write files to locations outside the intended output directory. This could overwrite sensitive files such as cron jobs or CI artifacts, and potentially execute code if the written file is executed as a script.

Impact

Exploitation of this vulnerability allows for arbitrary file writes via path traversal, with the potential to overwrite sensitive files and execute code, depending on the file's location and the user's privileges.

Reproduction

To reproduce this vulnerability, run a malicious Mailpit server that returns a crafted message with an ID containing traversal sequences. Then, use the 'mailpit dump --http' command to download messages from the malicious server, specifying a directory for the output. The server-controlled message ID will traverse the file system and write a file to an unintended location, such as the user's home directory or a CI artifact directory.

Remediation

Users are advised to upgrade to Mailpit version 1.30.0 or later, where this vulnerability has been patched.