Description
postal-mime before 4.2.1 contains a parser differential vulnerability in its address parser that truncates the domain at folding whitespace or comments preceding a dot. Remote attackers can craft From headers that pass SPF/DKIM/DMARC alignment for their own subdomain while PostalMime.parse() reports a spoofed victim sender address.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| postalsys | postal-mime | < 4.2.1 | 4.2.1 |
References
- GitHub Security Advisory (GHSA-jh3p-792r-98gm) vendor-advisory
- https://github.com/postalsys/postal-mime/commit/646725704463839f233472453b7c8306bd1dde21 patch
- postal-mime v4.2.1 Release Notes release-notes
- https://github.com/postalsys/postal-mime/blob/939a220bd518f54d98a088c315d7227e6215cae3/src/address-parser.ts#L265 technical-description
- VulnCheck Advisory: postal-mime before 4.2.1 Sender Spoofing via Address Parser Domain Truncation third-party-advisory