Spam via sendmessage.php?

[raywjohnson]

Not sure if this is just a clever spoof, a bug, or a security issue. But, it looks like someone is able to send spam from my install of vB (via the sendmessage.php). I have been getting one or two the following bounced emails every day for a week or so. (I cleaned it of site, domain, and server names).

This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

[email protected]
SMTP error from remote mail server after RCPT TO:<[email protected]>:
host bcgsa.com [206.130.110.179]: 550 5.1.1 <[email protected]>... User unknown

------ This is a copy of the message, including all the headers. ------

Return-path: <bounce@DOMAINNAME>
Received: from SERVERNAME ([127.0.0.1] helo=localhost)
by DOMAINNAME with esmtp (Exim 4.63)
(envelope-from <bounce@DOMAINNAME>)
id 1M132x-0000od-U4
for [email protected]; Mon, 04 May 2009 13:37:55 -0500
Date: Mon, 04 May 2009 18:37:47 +0000
To: [email protected]
From: "SITENAME" <webmaster@DOMAINNAME>
Auto-Submitted: auto-generated
Message-ID: <[email protected]>
MIME-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 8bit
X-Priority: 3
X-Mailer: vBulletin Mail via PHP
X-EZbouncer: http://www.DOMAINNAME/admincp/ezbounce.php?u=
Subject: [email protected]
X-Spam-Report: Spam detection software, running on the system "SERVERNAME.DOMAINNAME", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: Della Riley, This is a message from Kayla Trujillo ( mailto:
) from the SITENAME ( http://www.DOMAINNAME/ ). The message is as follows:
[...]
Content analysis details: (-0.2 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-1.4 ALL_TRUSTED Passed through trusted hosts only via SMTP
2.5 URI_NOVOWEL URI: URI hostname has long non-vowel sequence
-1.3 AWL AWL: From: address is in the auto white-list


Della Riley,

This is a message from Kayla Trujillo ( mailto: ) from the SITENAME ( http://www.DOMAINNAME/ ).

The message is as follows:

38jkwskkr2m1lzdb
<a href= http://zlqhmztvas.com >tplnh mzfv</a>

http://wjcwhrvwwdtz.com

<a href= http://kmoqzgk.com >msxhfpz idyfjga</a>

http://cwzyvgtldb.com

<SNIPPED>

SITENAME takes no responsibility for messages sent through its system.

The usernames (Della Riley and Kayla Trujillo) do not exist (in my user table), nor does the email address: [email protected].

I notice the ( mailto: ) is blank and the userid is missing from: /admincp/ezbounce.php?u=

Thanks for any assistance or insight.

--RayJ

[Wayne Luke]

Well sendmessage.php is the contact form and doesn't require a username or password to use. It appears you have a modification that sends a copy of the message to the user and that is what bounced. The original would have went to whatever email you have set up for email contact.

I don't know what the file ezbounce.php is. That isn't a vBulletin file.

[raywjohnson]

Well sendmessage.php is the contact form and doesn't require a username or password to use.

I know this. It is sending to an email address that I have not setup for it to send to. It should only send to one of two email addresses (I would receive the email from either).

It appears you have a modification that sends a copy of the message to the user and that is what bounced.

I do not have a modification that does this.

The original would have went to whatever email you have set up for email contact.

I did not receive any original. The headers of the email show: To: [email protected]

The AdminCP -> vBulletin Options -> Site Name / URL / Contact Details -> Contact Us Options setting has only one email address. I would receive email sent to that address, as well as the default "webmaster" address. I did not receive the original. This email was somehow sent to [email protected]. That is the problem.

I don't know what the file ezbounce.php is. That isn't a vBulletin file.

EZ Bounce is a mod. It adds that header. That way I can just click on it when I get a legit bounce for a real user. It is not the problem. However, since the the userid is missing, it shows that the email is being send from a guest/not logged in user. Again, how are they making it send to an arbitrary email address?

--RayJ

PS: I have not ruled out that this is a clever spoof email, designed to look like it was sent from our sendmessage.php script. But, the headers indicate that it was.

[peterska2]

AdminCP > Usergroups > Usergroup Manager > Unregistered/Not Logged in > Edit Usergroup > Can Use Email to Friend > No

AdminCP > Usergroups > Usergroup Manager > Unregistered/Not Logged in > Edit Usergroup > Can Email Members > No

[raywjohnson]

Solved

Thanks! That was the problem!

--RayJ

[raywjohnson]

RATS! Maybe not solved...

I checked the wrong user group..

When I did check these groups:

• (COPPA) Users Awaiting Moderation
• Unregistered / Not Logged In
• Users Awaiting Email Confirmation

they all have:

• Can Use Email to Friend
• Can Email Members

set to No.

Hmmm...

--RayJ

[raywjohnson]

I went over the permissions for the Unregistered / Not Logged In group. I changed a few and saved. Then I ran the Rebuild Bitfields tool.

I suspect that something is amiss/corrupt with my usergroup permissions.

I attempted to Send to Friend while not logged in, it just sent me to the login page. So it is working as expected.

--RayJ

[peterska2]

The only other place is

AdminCP > vBulletin Options > vBulletin Options > Site Name / URL / Contact Details >
Allow Unregistered Users to use 'Contact Us'

[raywjohnson]

Thanks.

I need to keep that one available for various reasons. I will monitor this for now. I may work on a plugin to add the IP address, referrer, etc to the headers. Might help me track down the problem.

--RayJ

[raywjohnson]

I think I found the problem. It is not the sendmessage.php/Contact Us script/page that is the problem. It is: blog.php?do=sendtofriend that is open to abuse. I have not yet found a setting to disable that.

Also, I have the email log activated (and working), but it does not log the blog/sendtofriend emails.

--RayJ

[Dan Druff]

The above is correct. The exploit is in blog.php in the sendtofriend functionality.

Two ways to stop this:

1) You can remove the E-mail to a friend link from the blog_show_entry template. Search for "email" in the template and you will see a fairly obvious vb:if block where this is done.

-or-

2) Go into blog.php and comment out all of the functionality of the "start sendtofriend" routines (there are two of them in vB4).


I did both and solved the issue.

[raywjohnson]

Yep. Thanks for the reminder. I did that after not being able to find any setting permission to disable it. Thanks!

--RayJ

[alaska_av8r]

Can you guys be a bit more specific on what I need to do in Blog.php to stop this:

(2) Go into blog.php and comment out all of the functionality of the "start sendtofriend" routines (there are two of them in vB4 ----- what text am I specifically looking for to comment out????


well I tried to figure out exactly what to remove from blog_show_entry template and couldn't figure that one out either, could you point me to the specific language there as well. (sorry I am not that programming literate)



The spammers have been hammering my website and I need to disable this. I have all usergroup permissions to email etc turned off.

thank you.

[raywjohnson]

Greetings alaska_av8r,

I am traveling out of the country until after the 29th of October. I will be able to guide you after that. Sorry!

--RayJ

[alaska_av8r]

Thank you RayJ, have safe and fun travels, I will be looking forward to hearing from you since I still cannot figure it out.