Scans targeting e-mail scripts have recently appeared on SANS honeypots, according to Johannes B. Ullrich, Dean of Research at SANS.edu. The requests include paths such as /sendmail.php, /test-mail.php, /email-test.php and /mailtest.php. Ullrich said the activity may come from spammers seeking web forms that let them choose a message’s recipient, though the scans cannot be tied to a specific vulnerability.
The activity recalls early web application flaws such as CVE-2000-0411, which affected a CGI script used to send e-mail. In that case, adding parameters to a URL could expose environment variables. Other vulnerabilities let users set the recipient address, while passing parameters directly to the sendmail binary could, in some cases, enable arbitrary code execution.
Ullrich noted that several scanned filenames contain the word “test,” suggesting attackers may be looking for scripts left behind during development. He also described a sample mail-testing script found through a Google Search. It accepted a recipient address through a URL parameter and included server configuration details in the message, making it unsuitable for use on a live site.
The broader concern, Ullrich said, is code hygiene: development artifacts should not be left on production websites. He recommended checking owned systems for such files, while stressing that these issues are best caught during application deployment.
Sources: SANS Internet Storm Center.