Hey guys,
I need your help validating what I would call a serious email bug. I'm on the latest version of Enhance. I did report this to Adam in Feb 2023 but for me it's still present after the email overhaul.
TL;DR: Customers can send as any email account (via PHP), and it's received by the recipient as a valid email (just as if the customer sent it via an authenticated SMTP transaction via the email client). "Valid email" = DKIM, SPF, DMARC = Passed
My Setup
- Smart Host enabled via Amazon SES
- Added
domain.com as a valid identity to SES
- Latest version of Enhance
- Customer 1 account has an email
customer1@domain.com and Email is assigned as Server1
- Customer 2 has no emails but has assigned Email as Server1
To reproduce
- Login to Enhance and impersonate Customer 2
- Add a file named
email_test.php to public_html with the following content:
<?php
$to = "ANY_EMAIL_I_USED@GMAIL.COM";
$subject = "Password Change";
$txt = "Change your password by visiting here";
$headers = "From: customer1@domain.com";
mail($to, $subject, $txt, $headers);
?>
- Make sure the
$headers variable is using the same email as Customer 1 (customer1@domain.com)
- Execute the script in your browser
- Look at the headers of the received email at the recipients email
In the end, I was expecting Gmail is block it, mark it as spam, or whatever, but the fake email is routing through Amazon SES as a legitimate email. I think I was even expecting the Customer 2 to be blocked immediately as they do not have permission to send an email from Customer 1 however, I'm well aware that it should have come from Customer 2's "system email account" instead.
Questions
- Does this happen to you?
- I see mailbaby integrations a lot; does this happen with mailbaby?
- I do not have the facility to test without a smart host; but if anyone is not using a smart host; does this happen to you?
Thanks,
Sully
