Web應用安全之發送郵件問題概要郵件頭注入産生原因

??ｮ?｢??ｦ??ｦ?

1.??ｮ?ｻｶ?､ｴ?ｳｨ??･

2.?ｽｿ??ｨhidden?????ｰ?ｿ??ｭ???ｶ?ｻｶ?ｺｺ?ｿ｡??ｯ

3.??ｮ?ｻｶ?????｡??ｨ????ｼ???ｾ?ｽｬ???

??ｮ?ｻｶ?､ｴ?ｳｨ??･

???????ｿ???ｮ?ｻｶ?ｶ???ｯ?ｸｭ?????ｶ?ｻｶ?ｺｺ???????｢??ｭ??ｭ??ｮｵ?ｸｭ?????･??｢?｡??ｬｦ?ｼ??ｻ?????ｷｻ?????ｰ?????ｮ?ｻｶ?､ｴ?ｭ??ｮｵ????ｯ｡??ｹ??ｮ?ｻｶ?ｭ｣????????ｻ??ｻ????ｮｵ???

?ｽｱ????ｦ??ｸ??ｼ? 1.????｢??ｼ?????ｻｶ?ｺｺ?ｼ?????ｭ｣????｢ｫ??ｴ??ｹ 2.?｢ｫ??ｨ??･???????????ｾ??ｮ?ｻｶ 3.?｢ｫ??ｨ??･??????????ｯ???ｮ?ｻｶ

??ｲ?????ｹ?ｳ??ｼ? 1.??ｮ?ｻｶ?､ｴ?ｻｲ?ｸ?????ｮｸ?????ｫ?､?????ｼ???･????????ｰ 2.????ｿ???｡?ｪ??ｸ?????ｮｸ?､?????ｼ???･????????ｰ?????ｫ??｢?｡??ｬｦ

?ｸ???ｬ?????ｨmb_send_mail??･????????ｮ?ｻｶ?ｼ?????ｸｪ?????ｰ?ｸｺ mb_send_mail?ｼ??????ｶ?ｻｶ?ｺｺ??ｰ???????ｼ????????｢?????ｼ?????ｭ｣???????ｼ?. $body?ｼ????From?ｼ????.$from?ｼ? ?ｸ??ｿｰ??ｽ??ｰ?????ｨ?ｬｬ????ｸｪ??ｽ??ｰ?ｼ?????????ｮ?ｻｶ?､ｴ?ｼ?????ｮ????????ｺｺ?ｼ?From?ｼ???ｰ??????

??ｳ?ｺ??ｬｬ????ｸｪ??ｽ??ｰ additional_headers?｢ｫ?????･??ｨ??ｮ?ｻｶ?､ｴ?????ｫ?ｰｾ????ｸｸ??ｨ?ｺ??｢?????｢??､?????､ｴ???????ｿ???｢?｡??ｬｦ?ｼ????\n????ｼ??ｿ??｡????????ｼ???ｯ?ｻ･????ｮ??､??ｸｪ?､ｴ???

??ｻ??ｻ??ｹ?ｼ?1 ?ｷｻ?????ｶ?ｻｶ?ｺｺ ????ｿ???｢?｡??ｾ???･?､??ｸｪ??ｮ?ｻｶ??ｰ????ｼ??ｦ???ｾ

??????????ｼ??ｸ､?ｸｪ??ｮ?ｮｱ??ｽ??ｶ??ｰ?ｼ??ｽ???ｯ?ｬｬ?ｸ??ｸｪ??ｮ?ｮｱ?ｸ???･????ｯ･??ｮ?ｻｶ?ｹ?????ｻ??ｺ??ｬｬ?ｺ??ｸｪ??ｮ?ｮｱ?ｼ?????ｸｺ?ｷｻ????ｬｬ?ｺ??ｸｪ??ｮ?ｮｱ??ｶ?ｼ??????ｨ?ｺ?Bcc?ｼ??ｯ?????ｼ??????ｹ?ｼ????

??ｻ??ｻ??ｹ?ｼ?2 ?ｯ｡??ｹ?ｭ｣??? ??ｨ??ｮ?ｻｶ??ｰ???????????･?ｸ??｡??ｩｺ??ｼ??ｳ??ｯ [emailﾂ?protected]

Bcc:[emailﾂ?protected]

Hack!!!! ?ｮ??????ｻ??ｻ?ｸｭ?ｼ??ｽｿ??ｨ?､ｧ????ｩｺ?｡??ｿｷ?????ｨ??ｷ?ｼ????????ｽｿ??ｨMIME??･???????????｢????ｭ｣????ｶ???ｯ???

??ｻ??ｻ??ｹ?ｼ?3 ?ｷｻ???????ｻｶ ??ｶ?????ｩ??ｨMIME???multipart/mixed?ｽ｢?ｼ????

?ｺｧ?????????

??ｮ?ｻｶ?ｶ???ｯ??ｼ?ｼ??ｼ? ?ｸ?HTTP?ｱｻ?ｼｼ ?ｶ???ｯ?､ｴ?ｼ? To?ｼ?[emailﾂ?protected] Subject: =?ISO-2022-JP?B?GyRCTGQkJDlnJG8kOyQsJCIbKEI=?==?ISO-2022-JP?B?GyRCTGQkJDlnJG8kOyQsJCIbKEI=?= From: [emailﾂ?protected] Content-Type: text/plain; charset=ISO-2022-JP ?ｩｺ?｡? ?ｭ｣????ｼ?dhaiuogdoiagd

To?ｸｺ??ｶ?ｻｶ?ｺｺ?ｼ?Subject?ｸｺ????｢??ｼ?From?ｸｺ????ｻｶ?ｺｺ??ｰ????????ｮ?ｻｶ?､ｴ?ｳｨ??･????ｸｻ?ｦ????????ｸ?HTTP?ｶ???ｯ?､ｴ?ｳｨ??･?ｼ??ｴ??ｱｻ?ｼｼ????ｶ???ｯ?､ｴ?ｸｭ????ｭ??ｮｵ?ｻ･??｢?｡??ｬｦ????ｼ??ｼ?????ｭ､?ｼ??ｦ??????ｽ?､???ｨ?､?????ｼ???･????????ｰ?????･??｢?｡??ｬｦ?ｼ???｣?ｹ??ｰｱ??ｯ?ｻ･?ｷｻ?????ｰ????ｶ???ｯ?､ｴ

?ｯｹ?ｭ? 1.?ｽｿ??ｨ?ｸ???ｨ????ｨ??ｺ??ｺ???･????????ｮ?ｻｶ

2.?ｸ??ｰ??､?????ｼ???･????????ｰ?????ｫ??ｨ??ｮ?ｻｶ?､ｴ?ｸｭ

3.????????ｮ?ｻｶ??ｶ?｡ｮ?ｿ??､?????ｼ???･????????ｰ?ｸ??????ｫ??｢?｡??ｬｦ ?ｸ???ｴ??･?ｰ???ｨmb_send_mail?ｼ??ｼ?????ｸ???ｨ??ｨ?ｺ?????????ｮ?ｻｶ???????｣???ｽ??ｰ?ｼ??ｹｶ??ｨ??ｽ??ｰ?ｸｭ??｡?ｪ???｢?｡??ｬｦ??? ??ｦ?､??ｼ???ｨ?｡???ｶ????ｾ????????????ｮ?ｻｶ?????ｽ?ｸｭ?ｵ???･??｡?ｪ???｢?｡??ｬｦ?ｹ??????????

4.?ｾ???･??｡?ｪ?

5.??｡?ｪ???ｮ?ｮｱ??ｰ???

6.??｡?ｪ?????｢???｡?ｪ???ｧ??ｶ?ｭ??ｬｦ?ｼ???ｪ?ｸ???ｧ??ｶ?ｭ??ｬｦ?ｻ･?､?????ｭ??ｬｦ??ｸ??ｹ??????