7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-jj37-3377-m6vv

GHSA-jj37-3377-m6vv: Duplicate Advisory: Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-mm7p-fcc7-pg87. This link is maintained to preserve external references.

Original Description

A vulnerability was identified in the email parsing library due to improper handling of specially formatted recipient email addresses. An attacker can exploit this flaw by crafting a recipient address that embeds an external address within quotes. This causes the application to misdirect the email to the attacker's external address instead of the intended internal recipient. This could lead to a significant data leak of sensitive information and allow an attacker to bypass security filters and access controls.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-jj37-3377-m6vv

GHSA-jj37-3377-m6vv:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
nodemailer	npm	< 7.0.7	7.0.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the addressparser library of Nodemailer, specifically within the _handleAddress function. The function is responsible for parsing email addresses from a string of tokens. The flaw was that the function did not distinguish between regular text and text enclosed in quotes when identifying email addresses. According to email standards (RFC 5321/5322), the local part of an email address can be a quoted string, which can legally contain an '@' symbol (e.g., "local@part"@domain.com).

The vulnerable version of _handleAddress would scan the entire string for patterns matching an email address. When given a crafted input like "attacker@malicious.com"@intended.com, it would incorrectly extract attacker@malicious.com as the recipient, ignoring the intended domain. This would cause the email to be misdirected to the attacker.

The patch, identified in commit 1150d99fba77280df2cfb1885c43df23109a8626, rectifies this by introducing state tracking to identify when the parser is inside a quoted string. It adds a textWasQuoted flag to tokens that originate from a quoted section. The logic for extracting email addresses is then modified to explicitly ignore any text that was quoted, thus ensuring that only the legitimate, top-level email address is parsed. The _handleAddress function is the precise location of this flawed logic and is therefore the vulnerable function.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.