DeltaHF
Well-known member
- Affected version
- v2.2.3 Patch 1
It is trivial to bypass XenForo email bans using sub-addressing (also known as "plus addressing") or, for some email providers such as Gmail, by inserting
To reproduce:
Although the
From Wikipedia:
Bypassing XenForo's email ban could be prevented by stripping
.
dots between the local-part characters of the address.To reproduce:
- Ban
example@gmail.com
. - Attempt to register a new account with
example+alias@gmail.com
. The request should be blocked but it will be successful and the registration confirmation email will be delivered toexample@gmail.com
. - Attempt to register a new account with
ex.ample@gmail.com
. The request should be blocked but it will again be successful with the registration confirmation email delivered toexample@gmail.com
.
Although the
+
or .
characters could simply be banned, they are widely used for legitimate reasons.From Wikipedia:
Subaddressing
Some mail services support a tag included in the local-part, such that the address is an alias to a prefix of the local part. For example, the address joeuser+tag@example.com denotes the same delivery address as joeuser@example.com. RFC 5233,[13] refers to this convention as sub-addressing, but it is also known as plus addressing, tagged addressing or mail extensions.
Addresses of this form, using various separators between the base name and the tag, are supported by several email services, including Andrew Project (plus),[14] Runbox (plus), Gmail (plus),[15] Rackspace (plus), Yahoo! Mail Plus (hyphen),[16] Apple's iCloud (plus), Outlook.com (plus),[17] ProtonMail (plus),[18] Fastmail (plus and Subdomain Addressing),[19] postale.io (plus),[20] Pobox (plus),[21] MeMail (plus),[22] MMDF (equals), Qmail and Courier Mail Server (hyphen).[23][24] Postfix and Exim allow configuring an arbitrary separator from the legal character set.[25][26]
The text of the tag may be used to apply filtering, or to create single-use, or disposable email addresses.
Bypassing XenForo's email ban could be prevented by stripping
.
characters and dropping any +aliases
from the local-part of email addresses before comparing them against the forum's banned email list. This would allow legitimate users to continue using dots and plus-addressing aliases in their email addresses while preventing malicious users from abusing these email features.