CyberRota Analysis
AI-GeneratedMailpit versions 1.29.0 to 1.30.6 are vulnerable due to improper handling of WebSocket origin checks, allowing attackers to exploit the system and access sensitive email data from unauthenticated instances. This vulnerability can lead to unauthorized exposure of live message IDs, sender and recipient information, and email content when users visit a malicious site. Organizations using Mailpit without additional authentication measures should prioritize upgrading to version 1.30.6 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Mailpit is an email testing tool and API for developers. From 1.29.0 until 1.30.6, Mailpit's server/server.go origin middleware checks the raw RequestURI for the /api/ prefix while Go's ServeMux routes using the percent-decoded URL path, and server/websockets/client.go configures websocket.Upgrader.CheckOrigin to return true. A malicious website can request /%61pi/events, skip corsOriginAccessControl(), reach the /api/events WebSocket handler, and receive live message IDs, Message-Id values, sender and recipient fields, subjects, tags, and body snippets from an unauthenticated default Mailpit instance after the user visits the site. This is a regression of the earlier WebSocket origin protection and does not affect deployments protected by --ui-auth-file. This issue is fixed in version 1.30.6.