不中用 Posted April 16, 2015 Share Posted April 16, 2015 . This little icon that you find everywhere on your board, in default setting, your board will allow GUESTS to send emails at random from your server .. This means : any sender email address can be used ( no restrictions, let your imagination work ( would be nice to hear some ideas!! ) drugs@forfree dot com ) "Subject" field can be changed in whatever ............... "Message" is a full editor .. links, pictures, .. spam can be send from your board without you knowing .. Because it is not really a bug .. the settings are there to change it easily .. but this is a serious vulnerability .. you open up your server to send out whatever malicious emails with your board logo/name on top .. your (mail) domain can be blacklisted in no time without you even know what happened .. there is no log or anything .. Other member groups, besides "guests", use the proper member/account email. I've checked a few websites here on the IPS (signature links) and many forgot about this one .. it should be set properly .. ASAP. System > Sharing Change to : . sobrenome, Skipy7, Misi and 9 others 12 Link to comment Share on other sites More sharing options...
tAPir Posted April 16, 2015 Share Posted April 16, 2015 Thanks for spotting this. I hadn't even realized that guests could do anything by default. Link to comment Share on other sites More sharing options...
不中用 Posted May 26, 2015 Author Share Posted May 26, 2015 .bump .. better to check again if your site hasn't have this switch ON for guests .. . Link to comment Share on other sites More sharing options...
TheSonic Posted May 26, 2015 Share Posted May 26, 2015 Wooo... I missed that one! Thank you very much for sharing. Link to comment Share on other sites More sharing options...
Management Charles Posted May 26, 2015 Management Share Posted May 26, 2015 Please be careful on what you call a "security" problem as people will get unnecessarily scared This is more of an annoyance that could cause spam. There is no security implication here. However, the default on this is already to not allow Guests to use it. You probably upgraded from an older version where the default was not set in this way. sobrenome, Flitterkill, MADMAN32395 and 2 others 5 Link to comment Share on other sites More sharing options...
Jswerv3 Posted May 26, 2015 Share Posted May 26, 2015 ^ rekt Tripp★ 1 Link to comment Share on other sites More sharing options...
不中用 Posted May 26, 2015 Author Share Posted May 26, 2015 Please be careful on what you call a "security" problem as people will get unnecessarily scared This is more of an annoyance that could cause spam. There is no security implication here. However, the default on this is already to not allow Guests to use it. You probably upgraded from an older version where the default was not set in this way. . Maybe you are a too good person Charles .. and you don't see the bad "Open Relay Security Guidelines" .. there will be more spam stories then nightmare ones .. but it is too "open" to say how lucky you can be if you're not careful enough .. Unnecessarily scared ? You not see your customers/clients as puppies aren't you ? . Link to comment Share on other sites More sharing options...
Management Charles Posted May 26, 2015 Management Share Posted May 26, 2015 I am not saying it's a good thing I am just saying it's not a "security" issue in that it's not going to get you hacked or anything like that. Link to comment Share on other sites More sharing options...
Lee69 Posted May 27, 2015 Share Posted May 27, 2015 Updated our permissions, thanks. Link to comment Share on other sites More sharing options...
The Old Man Posted May 30, 2015 Share Posted May 30, 2015 (edited) Thanks for highlighting this, certainly good advice to double check how you have it set rather than overlooking it and assuming. #BestPracticeI've seen permissions get changed by upgrades over the years that I know 100% I never set that way. Edited May 30, 2015 by The Old Man Link to comment Share on other sites More sharing options...
The Old Man Posted May 30, 2015 Share Posted May 30, 2015 (edited) Just checked any my 3.4.8 and 4.0.4 boards were set to allow everyone (including guests) to use the email as well! Thanks again. Edited May 30, 2015 by The Old Man Link to comment Share on other sites More sharing options...
Recommended Posts