Blog posts

Email Header Injection in mime-mail

By James Parker - May 23, 2017

mime-mail is a Haskell library used to compose and render emails. It is typically used in server-side software to send automated emails or construct emails from user supplied inputs.

While working on a website where I was constructing emails with POST data supplied by the user, I discovered that the mime-mail package was vulnerable to a header injection vulnerability. When browsing mime-mail's source code, I noticed that email headers were not being sanitized before being rendered. This meant that an attacker could insert additional email headers by injecting CLRF (\r\n) characters between the malicious headers. As a result, attackers could control parameters including the From, To, Reply-To, CC, BCC, and Subject fields. Since the emails are sent from the website, attackers could use this vulnerability to send spam, phish users for credentials, leak private information, or deface the site.

We can demonstrate the vulnerability with ghci, Haskell's REPL:

Continue reading...

Handling Multiple POST Forms in Yesod

By James Parker - February 14, 2017

Yesod, a web framework for Haskell, provides convenient functionality that makes it simple to render and parse web forms. Unfortunately, it is not as elegant when it comes to implementing a POST handler that can process multiple web forms. This blog post presents one approach that simplifies the processing of multiple web forms in a single handler.

The first step to handling multiple POST forms is to use the identifyForm function. This function takes a string that uniquely identifies a given form and embeds a hidden field in the form (which is given as the second argument). When parsing a request’s POST data, if the hidden field’s identifier does not match the form’s unique identifier, parsing will return a FormMissing. This allows the request handler to parse other forms until one parses successfully. Here is an example of how to use identifyForm:

-- Data type for formA. 
data FormDataA = FormDataA Text

Continue reading...


Publications

Build It, Break It, Fix It: Contesting Secure Development

Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security (CCS 16)

Build It Break It: Measuring and Comparing Development Security

8th Workshop on Cyber Security Experimentation and Test (CSET 15)

LMonad: Information Flow Control for Haskell Web Applications

University of Maryland, Master's Thesis 2014

4D, N = 1 Supergravity Genomics

Isaac Chappell, Sylvester James Gates, Jr., William D. Linch III, James Parker, Stephen Randall, Alexander Ridgway, Kory Stiffler
Journal of High Energy Physics 2013 (10), 1-52

4D, N = 1 Supersymmetry Genomics (II)

Journal of High Energy Physics 2012 (6), 1-34

An Extended Detailed Investigation of First and Second Order Supersymmetries for Off-Shell N = 2 and N = 4 Supermultiplets

Symmetry 7 (2), 1080-1121

4D, N = 1 Supersymmetry Genomics (I)

Sylvester James Gates, Jr., James Gonzales, Boanne MacGregor, James Parker, Ruben Polo-Sherk, Vincent G.J. Rodgers, Luke Wassink
Journal of High Energy Physics 2009 (12), 008