Listen to this Post
The vulnerability arises from a misconfiguration in the Mailpit WebSocket server’s origin validation. In the `server/websockets/client.go` file, the `CheckOrigin` function within the `websocket.Upgrader` struct is explicitly set to return `true` for all incoming HTTP requests. This overrides the default behavior of the gorilla/websocket library, which normally validates that the `Origin` header of a WebSocket handshake request matches the request’s `Host` header, enforcing the Same-Origin Policy. By disabling this check, Mailpit accepts WebSocket connections from any origin. When a developer runs Mailpit locally on the default port 8025, any malicious website visited by that developer can execute JavaScript to initiate a WebSocket connection to ws://localhost:8025/api/events. The browser, seeing the permissive origin check, allows this cross-origin connection. The attacker’s script can then subscribe to and receive all events broadcast by the Mailpit server, leading to real-time interception of sensitive data including email contents, headers, and system metrics without the user’s knowledge.
DailyCVE Form:
Platform: Mailpit
Version: All versions
Vulnerability: WebSocket origin hijacking
Severity: Critical
Date: Not specified
Prediction: Patch expected soon
What Undercode Say:
Start Mailpit (default settings) mailpit Serve malicious PoC HTML from a different origin python3 -m http.server 8000
<!-- poc_websocket_hijack.html -->
<script>
const ws = new WebSocket('ws://localhost:8025/api/events');
ws.onmessage = function(event) { console.log('Hijacked:', event.data); };
</script>
How Exploit:
Malicious site scripts connect to local Mailpit WebSocket endpoint, receiving broadcast event data including email metadata and notifications.
Protection from this CVE
Remove or secure the `CheckOrigin` function to restore default gorilla/websocket same-origin validation.
Impact:
Real-time interception of email data, metadata, and server statistics, compromising confidentiality.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
