DEF CON 32 - Splitting the email atom exploiting parsers to bypass access controls - Gareth Heyes

The video demonstrates how RFC-compliant email addresses can be manipulated to bypass access controls through parsing discrepancies, leading to serious security vulnerabilities 0:00.

Key Takeaways:
• Email parsing discrepancies allow bypassing domain-based access controls as many systems incorrectly validate where RFC-compliant emails are actually delivered 2:05
• Encoded word attacks (RFC 2047) enable bypassing validation in systems using Ruby mail library, affecting major platforms like GitLab and GitHub 12:46
• The speaker achieved remote code execution in Juma using Punycode to inject style tags and exfiltrate tokens via CSS import chaining 28:35
• Unicode overflow techniques allow bypassing character restrictions by manipulating how higher Unicode values are truncated to ASCII 9:55
• Source routing and ancient protocols like UUCP "bang paths" can cause emails to route to completely different domains than expected 4:25

The research shows that email domains should never be used as a sole means of authorization due to these fundamental parsing vulnerabilities 35:25.

Sources:

• 0:00 Introduction to email parsing vulnerabilities
• 2:05 Explanation of email parsing complexity
• 4:25 Source routing and UUCP "bang paths"
• 9:55 Unicode overflow techniques
• 12:46 Encoded word attacks and Ruby mail library vulnerabilities
• 28:35