Title: TLDR: Inbound email routes don&#x27;t have SPF&#x2F;DKIM&#x2F;DMARC protection, meaning any inbound email sent to a webhook can be trivially spoofed &#x2F; phished.
Mailgun describe inbound routes as:<p>&quot;complex incoming messages are simplified and parsed into all of the data you need with Inbound Routes.&quot; [1]<p>Mailgun refers to DKIM&#x2F;SPF&#x2F;DMARC with:<p>&quot;Mailgun leads the charge in email authentication by requiring DKIM and SPF records by default before you can begin sending.&quot; [2]<p>However, nowhere does it say that Mailgun does not provide SPF or DKIM validation checks on inbound emails. Confusingly, these headers appear only for a subset of inbound emails.<p>Attack scenario:<p>1) Pick any domain using mailgun for inbound email processing (trivially found via MX records).<p>2) Spoof an email from any address you want to impersonate (eg. security@mailgun.com).<p>If that address is handled via an inbound route to a webhook (eg. CRM system &#x2F; other), then it will appear as from the spoofed sender without any DKIM&#x2F;SPF flags. This makes phishing via Inbound Routes trivial.<p>Requested fix:<p>Include SPF (X-Mailgun-Spf), DKIM (X-Mailgun-Dkim-Check-Result), and Spam Assassin headers (eg. DMARC_QUAR &#x2F; DMARC_REJECT &#x2F; DMARC_NONE &#x2F; DMARC_MISSING) headers for ALL inbound routes to a webhook. The application can then decide what to do.<p>Mailgun Response:<p>&quot;Our security team has confirmed that our routes act as an open relay and that this is not considered a security vulnerability with Mailgun.&quot;<p>Nowhere in the Mailgun documentation &#x2F; sales pages are inbound routes described like this, and in fact, they pretend to have protection as headers are sometimes present!<p>Note A: Using throwaway to not give information away for our own exposed systems.<p>Note B: The spoofed email must not trigger above a certain spam assassin threshold (this is fairly trivial to do and openly testable by any attacker), otherwise it might get blocked by higher level Mailgun spam handling.<p>[1] - <a href="https:&#x2F;&#x2F;www.mailgun.com&#x2F;products&#x2F;send&#x2F;inbound-routing&#x2F;" rel="nofollow noreferrer">https:&#x2F;&#x2F;www.mailgun.com&#x2F;products&#x2F;send&#x2F;inbound-routing&#x2F;</a><p>[2] - <a href="https:&#x2F;&#x2F;www.mailgun.com&#x2F;blog&#x2F;deliverability&#x2F;implement-dmarc&#x2F;#chapter-5" rel="nofollow noreferrer">https:&#x2F;&#x2F;www.mailgun.com&#x2F;blog&#x2F;deliverability&#x2F;implement-dmarc&#x2F;...</a>
Upvote: