GHSA-h3hj-cmcx-xc66: High severity npm/nodemailer vulnerability
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-p6gq-j5cr-w38f. This link is maintained to preserve external references.
Original Description nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowing authenticated attackers to read arbitrary files or perform server-side request forgery by supplying path or href properties. Attackers can exploit this by crafting raw messages with file paths or URLs that bypass the intended sandbox, with fetched content delivered in the outgoing message to attacker-controlled recipients.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nodemailerto a version that resolves this vulnerability.Fixed in 9.0.1 - Configuration
Ensure message-level raw option flags disableFileAccess and disableUrlAccess are correctly applied to raw options so file path (path) and URL (href) access is disabled (affected in nodemailer before 9.0.1).
nodemailer disableFileAccess / disableUrlAccess (message-level raw option) = true
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs authenticated access sufficient to supply a message-level raw option to Nodemailer. Exploitation also requires the ability to set path or href properties in the crafted raw message.
What is exposed if exploitation succeeds?
An attacker can read arbitrary files or trigger server-side requests through the affected Nodemailer process. Content obtained from a file or URL can be sent in an outgoing message to recipients controlled by the attacker.
Are installations with file and URL access disabled protected?
Not for message-level raw input in affected versions. The issue is that disableFileAccess and disableUrlAccess are not applied to that raw option, allowing the intended sandbox restrictions to be bypassed.
What versions are affected?
The original advisory identifies Nodemailer versions before 9.0.1 as affected. This advisory has been withdrawn as a duplicate of GHSA-p6gq-j5cr-w38f.