[ASM] Email injection: MimeKit and SimpleEmail #6614
+818
−192
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,41 @@ | ||
| // <copyright file="AmazonSimpleEmailAspect.cs" company="Datadog"> | ||
| // Unless explicitly stated otherwise all files in this repository are licensed under the Apache 2 License. | ||
| // This product includes software developed at Datadog (https://www.datadoghq.com/). Copyright 2017 Datadog, Inc. | ||
| // </copyright> | ||
| #nullable enable | ||
|
|
||
| using System; | ||
| using Datadog.Trace.AppSec; | ||
| using Datadog.Trace.Iast.Dataflow; | ||
|
|
||
| namespace Datadog.Trace.Iast.Aspects; | ||
|
|
||
| /// <summary> Email html injection class aspect </summary> | ||
| [AspectClass("AWSSDK.SimpleEmail", AspectType.Sink, VulnerabilityType.EmailHtmlInjection)] | ||
| [global::System.ComponentModel.Browsable(false)] | ||
| [global::System.ComponentModel.EditorBrowsable(global::System.ComponentModel.EditorBrowsableState.Never)] | ||
| public class AmazonSimpleEmailAspect | ||
| { | ||
| /// <summary> | ||
| /// Launches a email html injection vulnerability if the email body is tainted, it's not escaped and the email is html compatible. | ||
| /// </summary> | ||
| /// <param name="message">the email message that is going to be sent</param> | ||
| /// <returns>the MailMessage</returns> | ||
| #if NETFRAMEWORK | ||
| [AspectMethodInsertBefore("Amazon.SimpleEmail.AmazonSimpleEmailServiceClient::SendEmail(Amazon.SimpleEmail.Model.SendEmailRequest)")] | ||
| #endif | ||
| [AspectMethodInsertBefore("Amazon.SimpleEmail.AmazonSimpleEmailServiceClient::SendEmailAsync(Amazon.SimpleEmail.Model.SendEmailRequest,System.Threading.CancellationToken)", 1)] | ||
| public static object? Send(object? message) | ||
| { | ||
| try | ||
| { | ||
| IastModule.OnEmailHtmlInjection(message, EmailInjectionType.AmazonSimpleEmail); | ||
| return message; | ||
| } | ||
| catch (Exception ex) | ||
| { | ||
| IastModule.LogAspectException(ex, $"{nameof(MailkitAspect)}.{nameof(Send)}"); | ||
| return message; | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,30 @@ | ||
| // <copyright file="ISendEmailRequest.cs" company="Datadog"> | ||
| // Unless explicitly stated otherwise all files in this repository are licensed under the Apache 2 License. | ||
| // This product includes software developed at Datadog (https://www.datadoghq.com/). Copyright 2017 Datadog, Inc. | ||
| // </copyright> | ||
|
|
||
| using Datadog.Trace.DuckTyping; | ||
|
|
||
| namespace Datadog.Trace.Iast.Aspects; | ||
|
|
||
| #nullable enable | ||
|
|
||
| internal interface ISendEmailRequest | ||
| { | ||
| IMessage Message { get; } | ||
| } | ||
|
|
||
| internal interface IMessage | ||
| { | ||
| IBody Body { get; } | ||
| } | ||
|
|
||
| internal interface IBody | ||
| { | ||
| IHtml Html { get; } | ||
| } | ||
|
|
||
| internal interface IHtml | ||
| { | ||
| string Data { get; } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,22 @@ | ||
| // <copyright file="IMimeKitTextPart.cs" company="Datadog"> | ||
| // Unless explicitly stated otherwise all files in this repository are licensed under the Apache 2 License. | ||
| // This product includes software developed at Datadog (https://www.datadoghq.com/). Copyright 2017 Datadog, Inc. | ||
| // </copyright> | ||
|
|
||
| using System.Text; | ||
| using Datadog.Trace.DuckTyping; | ||
|
|
||
| namespace Datadog.Trace.Iast.Aspects; | ||
|
|
||
| #nullable enable | ||
|
|
||
| internal interface IMimeKitTextPart | ||
| { | ||
| string Text { get; set; } | ||
|
|
||
| bool IsHtml { get; } | ||
|
|
||
| void SetText(string charset, string text); | ||
|
|
||
| void SetText(Encoding encoding, string text); | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,111 @@ | ||
| // <copyright file="MailkitAspect.cs" company="Datadog"> | ||
| // Unless explicitly stated otherwise all files in this repository are licensed under the Apache 2 License. | ||
| // This product includes software developed at Datadog (https://www.datadoghq.com/). Copyright 2017 Datadog, Inc. | ||
| // </copyright> | ||
| #nullable enable | ||
|
|
||
| using System; | ||
| using System.Text; | ||
| using Datadog.Trace.AppSec; | ||
| using Datadog.Trace.DuckTyping; | ||
| using Datadog.Trace.Iast.Dataflow; | ||
|
|
||
| namespace Datadog.Trace.Iast.Aspects; | ||
|
|
||
| /// <summary> Email html injection class aspect </summary> | ||
| [AspectClass("Mailkit", AspectType.Sink, VulnerabilityType.EmailHtmlInjection)] | ||
| [global::System.ComponentModel.Browsable(false)] | ||
| [global::System.ComponentModel.EditorBrowsable(global::System.ComponentModel.EditorBrowsableState.Never)] | ||
| public class MailkitAspect | ||
| { | ||
| /// <summary> | ||
| /// Launches a email html injection vulnerability if the email body is tainted, it's not escaped and the email is html compatible. | ||
| /// We loose the tainted string when setting it to the email body because it's converted to a stream. | ||
| /// Therefore, we cannot check at the moment of sending and we need to instrument the body set text methods. | ||
| /// </summary> | ||
| /// <param name="instance">the email body instance</param> | ||
| /// <param name="encoding">the email encoding</param> | ||
| /// <param name="bodyText">the email text</param> | ||
| [AspectMethodReplace("MimeKit.TextPart::SetText(System.String,System.String)")] | ||
| public static void SetText(object instance, string encoding, string bodyText) | ||
| #pragma warning disable DD0005 | ||
| { | ||
| IMimeKitTextPart? textPart = ConvertToMimekit(instance); | ||
|
|
||
| if (textPart is not null) | ||
| { | ||
| textPart.SetText(encoding, bodyText); | ||
| CheckForVulnerability(bodyText, textPart); | ||
| } | ||
| } | ||
| #pragma warning restore DD0005 | ||
|
|
||
| /// <summary> | ||
| /// Launches a email html injection vulnerability if the email body is tainted, it's not escaped and the email is html compatible. | ||
| /// </summary> | ||
| /// <param name="instance">the email body</param> | ||
| /// <param name="encoding">the email ending</param> | ||
| /// <param name="bodyText">the email text</param> | ||
| [AspectMethodReplace("MimeKit.TextPart::SetText(System.Text.Encoding,System.String)")] | ||
| public static void SetTextSystemTextEncoding(object instance, Encoding encoding, string bodyText) | ||
| #pragma warning disable DD0005 | ||
| { | ||
| IMimeKitTextPart? textPart = ConvertToMimekit(instance); | ||
|
|
||
| if (textPart is not null) | ||
| { | ||
| textPart.SetText(encoding, bodyText); | ||
| CheckForVulnerability(bodyText, textPart); | ||
| } | ||
| } | ||
| #pragma warning restore DD0005 | ||
|
|
||
| /// <summary> | ||
| /// Launches a email html injection vulnerability if the email body is tainted, it's not escaped and the email is html compatible. | ||
| /// </summary> | ||
| /// <param name="instance">the email body</param> | ||
| /// <param name="bodyText">the email text</param> | ||
| [AspectMethodReplace("MimeKit.TextPart::set_Text(System.String)")] | ||
| public static void SetTextProperty(object instance, string bodyText) | ||
| #pragma warning disable DD0005 | ||
| { | ||
| IMimeKitTextPart? textPart = ConvertToMimekit(instance); | ||
|
|
||
| if (textPart is not null) | ||
| { | ||
| textPart.Text = bodyText; | ||
| CheckForVulnerability(bodyText, textPart); | ||
| } | ||
| } | ||
| #pragma warning restore DD0005 | ||
|
|
||
| private static void CheckForVulnerability(string bodyText, IMimeKitTextPart textPart) | ||
| { | ||
| try | ||
| { | ||
| if (textPart.IsHtml) | ||
| { | ||
| IastModule.OnEmailHtmlInjection(bodyText); | ||
| } | ||
| } | ||
| catch (Exception ex) | ||
| { | ||
| IastModule.LogAspectException(ex, $"{nameof(MailkitAspect)}.{nameof(CheckForVulnerability)}"); | ||
| } | ||
| } | ||
|
|
||
| private static IMimeKitTextPart? ConvertToMimekit(object instance) | ||
| { | ||
| IMimeKitTextPart? textPart = null; | ||
| try | ||
| { | ||
| textPart = instance.DuckCast<IMimeKitTextPart>(); | ||
| } | ||
| catch (Exception ex) | ||
| { | ||
| IastModule.LogAspectException(ex, $"{nameof(MailkitAspect)}.{nameof(ConvertToMimekit)} (DuckCast)"); | ||
| } | ||
|
|
||
| return textPart; | ||
| } | ||
| } | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,15 @@ | ||
| // <copyright file="EmailInjectionType.cs" company="Datadog"> | ||
| // Unless explicitly stated otherwise all files in this repository are licensed under the Apache 2 License. | ||
| // This product includes software developed at Datadog (https://www.datadoghq.com/). Copyright 2017 Datadog, Inc. | ||
| // </copyright> | ||
|
|
||
| #nullable enable | ||
|
|
||
| namespace Datadog.Trace.Iast; | ||
|
|
||
| internal enum EmailInjectionType | ||
| { | ||
| AmazonSimpleEmail, | ||
| MailKit, | ||
| SystemNetMail | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
|
|
@@ -850,7 +850,25 @@ internal static IastModuleResponse OnXpathInjection(string xpath) | |||||
| } | ||||||
| } | ||||||
|
|
||||||
| internal static void OnEmailHtmlInjection(string text) | ||||||
| { | ||||||
| if (!Iast.Instance.Settings.Enabled) | ||||||
| { | ||||||
| return; | ||||||
| } | ||||||
|
|
||||||
| OnExecutedSinkTelemetry(IastVulnerabilityType.EmailHtmlInjection); | ||||||
|
|
||||||
| if (string.IsNullOrEmpty(text)) | ||||||
| { | ||||||
| return; | ||||||
| } | ||||||
|
|
||||||
| // We use the same secure marks as XSS, but excluding db sources | ||||||
| GetScope(text, IntegrationId.EmailHtmlInjection, VulnerabilityTypeUtils.EmailHtmlInjection, OperationNameEmailHtmlInjection, taintValidator: Always, safeSources: _dbSources, exclusionSecureMarks: SecureMarks.Xss); | ||||||
| } | ||||||
|
|
||||||
| internal static void OnEmailHtmlInjection(object? message, EmailInjectionType type) | ||||||
| { | ||||||
| if (!Iast.Instance.Settings.Enabled) | ||||||
| { | ||||||
|
|
@@ -864,15 +882,37 @@ internal static void OnEmailHtmlInjection(object? message) | |||||
| return; | ||||||
| } | ||||||
|
|
||||||
| ExtractProperties(message, type, out var body, out var isHtml); | ||||||
|
|
||||||
| if (!isHtml || string.IsNullOrEmpty(body)) | ||||||
| { | ||||||
| return; | ||||||
| } | ||||||
|
|
||||||
| // We use the same secure marks as XSS, but excluding db sources | ||||||
| GetScope(body!, IntegrationId.EmailHtmlInjection, VulnerabilityTypeUtils.EmailHtmlInjection, OperationNameEmailHtmlInjection, taintValidator: Always, safeSources: _dbSources, exclusionSecureMarks: SecureMarks.Xss); | ||||||
| } | ||||||
|
|
||||||
| private static void ExtractProperties(object mail, EmailInjectionType type, out string? body, out bool isHtml) | ||||||
| { | ||||||
| switch (type) | ||||||
| { | ||||||
| case EmailInjectionType.SystemNetMail: | ||||||
| var mailMessage = mail.DuckCast<IMailMessage>(); | ||||||
| body = mailMessage?.Body; | ||||||
| isHtml = mailMessage?.IsBodyHtml ?? false; | ||||||
| break; | ||||||
| case EmailInjectionType.AmazonSimpleEmail: | ||||||
| var sendEmailRequest = mail.DuckCast<ISendEmailRequest>(); | ||||||
| body = sendEmailRequest?.Message?.Body?.Html?.Data; | ||||||
|
There was a problem hiding this comment.
Suggested change
iiuc, seems like we don't need all theses checks, as There was a problem hiding this comment. Yes, you are right. I will remove the nullability check in mail? Still, Message might be null, so I will keep those nullability checks. I have updated the code. Thanks! |
||||||
| isHtml = !string.IsNullOrEmpty(body); | ||||||
| break; | ||||||
| default: | ||||||
|
There was a problem hiding this comment. are we not checking There was a problem hiding this comment. We will not fall into default because we instrument Mailkit differently and we don't call this method when using Mailkit. The problem about mailkit is that we loose the tainting after setting the body text, so we cannot instrument the Send methods. |
||||||
| Log.Error("Error while checking for email injection type."); | ||||||
| body = string.Empty; | ||||||
| isHtml = false; | ||||||
| break; | ||||||
| } | ||||||
| } | ||||||
|
|
||||||
| public static void LogAspectException(Exception ex, string aspectInfo) | ||||||
|
|
||||||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
should we use
TryDuckCastinstead?There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We are following the same pattern in other aspects such as JsonDocumentAspects or JavaScriptSerializerAspects. I guess that we should probably log an DuckCast Failure/exception as error. WDYT?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
oh ok, makes sense to log, I just thought
TryDuckCastmight have been more performant, and then testing the bool result to log or not :idkThere was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
it says:
so I don't know if you expect the proxy to fail, maybe not so it's ok like this 🤔
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yes, it should not fail. I have tested different versions of the assembly and the proxy should not change.