Mailpit Unauthenticated Remote Denial-of-Service Vulnerability via Unrestricted Message Sizes

A denial-of-service vulnerability has been identified in Mailpit, an email testing tool for developers. Prior to version 1.30.0, the SMTP server and the HTTP /api/v1/send endpoint allowed unlimited message sizes, leading to excessive memory and disk usage. This flaw arises because the maximum size limit for incoming data is not properly set, leaving it at the default value of zero, which indicates no restriction. As a result, an attacker can exploit this vulnerability by sending large messages, causing the Mailpit process to consume excessive RAM and eventually crash. The issue is exacerbated by the fact that Mailpit's default settings require no authentication and expose the SMTP and HTTP services to the network.

Impact

Exploitation of this vulnerability causes the Mailpit process to crash due to out-of-memory conditions, disrupting the service. Additionally, each oversized message is saved to the SQLite database, potentially leading to significant disk space consumption.

Reproduction

The vulnerability can be reproduced by sending large messages via the SMTP server or the HTTP /api/v1/send endpoint. This can be done using a Python script that establishes a connection to the Mailpit server, bypassing the default message size limit. The script can be configured to send messages of various sizes, effectively overwhelming the server's resources.

Remediation

Users are advised to upgrade to Mailpit version 1.30.0 or later, where this vulnerability has been patched.