Listen to this Post
Mailpit’s thumbnail endpoint at `/api/v1/message/{id}/part/{partID}/thumb` fails to validate image dimensions before decoding. The handler accepts any attachment with a `Content-Type` starting with image/, retrieves the stored attachment bytes, and immediately passes them to `imaging.Decode()` without checking pixel count or estimated memory footprint. This decode step expands compressed image formats like PNG into full RGBA rasters. An attacker can craft a small PNG (e.g., 65 KB) that declares a large canvas (e.g., 4096×4096), which decodes to ~64 MB of memory before the endpoint scales it down to a fixed 180×120 thumbnail. The amplification factor can exceed 1000×. The default message-size limits do not mitigate this because they restrict encoded bytes, not decoded pixels. The UI also triggers this endpoint automatically when viewing messages with image attachments, and the API is often unauthenticated. A remote attacker can store a malicious email via SMTP or the Send API, discover its IDs via the API, and repeatedly request the thumbnail endpoint to force memory and CPU spikes. Concurrent requests can lead to process instability or denial of service. The attack requires only the ability to store an email and reach the web API. The issue is present in the latest release (v1.30.3) and current develop branch. No existing security advisory covers this specific decoded‑pixel amplification. A suggested fix is to decode only image headers first, compute an estimated decoded size, and reject oversized images before full rasterization.
DailyCVE Form:
Platform: Mailpit
Version: v1.30.3+develop
Vulnerability: Image dimension amplification
Severity: High
date: 2026-06-27
Prediction: 2026-08-15
What Undercode Say:
Run the provided PoC test to reproduce amplification
docker run --rm -v "$PWD:/src" -w /src golang:1.25 go test ./server/apiv1 -run 'TestThumbnail.DimensionAmplificationPoV' -v
Example curl to trigger the endpoint (replace IDs after storing an email)
curl -s "http://target:8025/api/v1/message/<message-id>/part/<part-id>/thumb" -o /dev/null
Monitor memory usage while firing concurrent requests
for i in {1..10}; do curl -s "http://target:8025/api/v1/message/<id>/part/<pid>/thumb" & done; wait
Exploit: (Educational Purposes!)
// Compile and run a Go program that stores an email with a high‑dimension PNG and repeatedly calls /thumb.
// The PoC code in the demonstrates the amplification. An attacker can automate:
// 1. Generate a 4096x4096 zero‑RGBA PNG (65 KB).
// 2. Send it as an attachment via SMTP or the /api/v1/send endpoint.
// 3. Parse the returned message ID and attachment PartID.
// 4. Loop GET requests to /api/v1/message/{id}/part/{partID}/thumb.
// 5. This forces the server to allocate ~64 MB per request, causing memory exhaustion.
Protection: from this CVE
- Reject oversized images before full decode by inspecting headers (e.g., PNG IHDR) and limiting pixel count to a safe cap (e.g., 4 MP).
- Apply this cap to all image formats and both inline/regular attachments.
- Return a 400 or a blank thumbnail for rejected images.
- Make the cap configurable and add regression tests.
- Consider rate‑limiting thumbnail requests and requiring authentication for API access.
Impact:
- Unauthenticated remote attacker can cause memory and CPU exhaustion.
- Repeated requests can lead to process instability, crashes, or denial of service.
- Affects all deployments with default unauthenticated HTTP API and reachable SMTP/Send endpoints.
- Amplification from small encoded payload (tens of KB) to hundreds of MB decoded memory.
- Risk increases with concurrent thumbnail requests.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
