Gmail Bugs Allow Changing From: Field and Spoofing Recipient's Address

guest · Nov 16, 2018

Gmail Bugs Allow Changing From: Field and Spoofing Recipient's Address
November 15, 2018
https://www.bleepingcomputer.com/ne...g-from-field-and-spoofing-recipients-address/

A bug in the way Gmail handles the structure of the 'From:' header could allow placing of an arbitrary email address in the sender field.
Although this issue opens the door for high-level abuse, at the very least it is possible to add the recipient's address and confuse them about the emails they sent and their content.

"So it appears that by structuring the From: field to contain the recipient’s address along with other text the GMail app reads the From field for filtering/inbox organization purposes" and sorts the message as if it were sent by the recipient, the developer explains.

However, there are higher risks. As Cotten explains, a threat actor targeting a business could seize the opportunity to plant malicious links. Furthermore, the developer told us that it is technically possible to add any email address to the header, between quotes, which would enable spoofing the sender.
Click to expand...

Log in or Sign up

Gmail Bugs Allow Changing From: Field and Spoofing Recipient's Address

guest Guest

Log in or Sign up

Gmail Bugs Allow Changing From: Field and Spoofing Recipient's Address

guest Guest

Useful Searches