{"action":"opened","issue":{"url":"https://api.github.com/repos/opensourceBIM/BIMserver/issues/279","labels_url":"https://api.github.com/repos/opensourceBIM/BIMserver/issues/279/labels{/name}","comments_url":"https://api.github.com/repos/opensourceBIM/BIMserver/issues/279/comments","events_url":"https://api.github.com/repos/opensourceBIM/BIMserver/issues/279/events","html_url":"https://github.com/opensourceBIM/BIMserver/issues/279","id":120701084,"number":279,"title":"Security Vulnerability - SMTP protection not used","user":{"login":"ketangodhani","id":5410937,"avatar_url":"https://avatars.githubusercontent.com/u/5410937?v=3","gravatar_id":"","url":"https://api.github.com/users/ketangodhani","html_url":"https://github.com/ketangodhani","followers_url":"https://api.github.com/users/ketangodhani/followers","following_url":"https://api.github.com/users/ketangodhani/following{/other_user}","gists_url":"https://api.github.com/users/ketangodhani/gists{/gist_id}","starred_url":"https://api.github.com/users/ketangodhani/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ketangodhani/subscriptions","organizations_url":"https://api.github.com/users/ketangodhani/orgs","repos_url":"https://api.github.com/users/ketangodhani/repos","events_url":"https://api.github.com/users/ketangodhani/events{/privacy}","received_events_url":"https://api.github.com/users/ketangodhani/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-12-07T05:18:21Z","updated_at":"2015-12-07T05:18:21Z","closed_at":null,"body":"Hi\r\n\r\nI'm checking your website found spf record there.\r\nYou should apply strict SMPT policy to stop spoofed email sending from your domain.\r\n\r\nAn attacker would send a Fake email from papers@bimserver.org saying that Please change your password, The victim is aware of phishing attacks, But when he sees that the mail originated from papers@bimserver.org , He has no other way than to believe it. Clicking on the link takes him to a website where certain JavaScript is executed which steals his Id and password (SESSION COOKIE). The results can be more dangerous.\r\n\r\n<?php\r\n$to = \"VICTIM@example.com\";\r\n$subject = \"Password Change\";\r\n$txt = \"Change your password by visiting here - \r\n[VIRUS LINK HERE]\";\r\n$headers = \"From: papers@bimserver.org\";\r\nmail($to,$subject,$txt,$headers);\r\n?>\r\nFix :\r\n\r\nYour SPF record is\r\n\r\nNo valid SPF record found of either type TXT or type SPF\r\n\r\nIt should be\r\n\r\nFail with - sign\r\n\r\nI strongly recommend you to read this article :\r\n\r\nhttps://www.digitalocean.com/community/tutorials/how-to-use-an-spf-record-to-prevent-spoofing-improve-e-mail-reliability\r\n\r\nYou can check your SPF here:\r\n\r\nhttp://www.kitterman.com/spf/validate.html\r\n\r\nPOC: Find Attachment\r\n\r\n![bimserver_1](https://cloud.githubusercontent.com/assets/5410937/11619599/e41fb41c-9ccf-11e5-8973-5f27e509d979.PNG)\r\n![bimserver_2](https://cloud.githubusercontent.com/assets/5410937/11619600/e421ee9e-9ccf-11e5-89d5-7fa2f679a5d6.PNG)"}}