Bernd RodlerandClaude Opus 4.8
f7e487171c
S-01 audited bulwarkmail/plugins/smime @ 91085a3 (2,935 lines). Nine findings, two HIGH. No backdoor and no exfiltration path anywhere in the bundle — the problems are trust-model and input-validation gaps. Full report in vnc/audits/SMIME-PLUGIN-AUDIT-2026-08-04.md. Fork is source-only. The upstream smime.zip is a 1.77 MB prebuilt bundle whose manifest reads 1.0.1 while the source reads 1.0.2, so auditing src/ would not audit what that zip installs. We build from source. Finding 1 (HIGH) — certificate substitution. maybeAutoImportSigner gated on signatureValid alone, but smimeVerify runs checkChain:false, so that only proves "signed by whoever holds this key", not that the claimed identity is real. Self-sign a cert asserting victim@example.com, send one signed message, and it was stored as the encryption target for that address — the user's next Encrypt to the victim went to the attacker. Now requires signerEmailMatch === true and !selfSigned. Both values were already computed and displayed as untrusted in the banner; only the import path ignored them. Tests for `true` explicitly so an undefined match (missing From header) fails closed. Finding 3 (MED-HIGH) — CRLF header injection. Escaping reached only Subject and attachment filename; display names, raw addresses, Message-ID, In-Reply-To, References and attachment Content-Type were emitted verbatim, and formatAddress escapes only backslash and quote. In-Reply-To/References/display names are copied from inbound mail when replying or forwarding, so the value is attacker-supplied. Sanitising inside formatHeader covers all 17 call sites by construction; the three headers assembled directly get stripCrlf explicitly. Also adds auth:observe to the manifest. The plugin registers onAfterLogout/onAccountSwitch — real hooks (lib/plugin-hooks.ts:362-363) — without declaring the permission, so under B-09 the session-key wipe would silently stop running. verify-fixes.mjs carries 19 assertions including source checks that fail if either guard is removed or a new unsanitised interpolated header appears. That last one immediately caught the interpolated smime-type Content-Type header, which manual review had dismissed as static. Finding 2 (unauthenticated CBC accepted on decrypt) is NOT fixed. This is not safe for real mail yet — sandbox accounts only. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
54 lines
1.8 KiB
JavaScript
54 lines
1.8 KiB
JavaScript
import * as pkijs from 'pkijs';
|
|
import { parseCertificateDer } from './certificate-utils.js';
|
|
import { nativeEngine } from './crypto-engine.js';
|
|
import { toHex } from './util.js';
|
|
|
|
/**
|
|
* Produce CMS EnvelopedData for the given MIME content.
|
|
* Content type: application/pkcs7-mime; smime-type=enveloped-data.
|
|
* Always includes the sender's cert so the sender can decrypt their Sent mail.
|
|
* Ported from lib/smime/smime-encrypt.ts.
|
|
*/
|
|
export async function smimeEncrypt(mimeBytes, recipientCertsDer, senderCertDer, useAes128) {
|
|
const allCertDers = deduplicateCerts([...recipientCertsDer, senderCertDer]);
|
|
if (allCertDers.length === 0) throw new Error('No recipient certificates provided');
|
|
|
|
const recipientCerts = allCertDers.map((der) => parseCertificateDer(der));
|
|
const cmsEnveloped = new pkijs.EnvelopedData();
|
|
|
|
for (const cert of recipientCerts) {
|
|
cmsEnveloped.addRecipientByCertificate(cert, { oaepHashAlgorithm: 'SHA-256' }, undefined, nativeEngine());
|
|
}
|
|
|
|
const contentEncryptionAlgorithm = useAes128
|
|
? { name: 'AES-GCM', length: 128 }
|
|
: { name: 'AES-GCM', length: 256 };
|
|
|
|
await cmsEnveloped.encrypt(
|
|
contentEncryptionAlgorithm,
|
|
mimeBytes.buffer.slice(mimeBytes.byteOffset, mimeBytes.byteOffset + mimeBytes.byteLength),
|
|
nativeEngine(),
|
|
);
|
|
|
|
const cms = new pkijs.ContentInfo({
|
|
contentType: '1.2.840.113549.1.7.3', // id-envelopedData
|
|
content: cmsEnveloped.toSchema(),
|
|
});
|
|
|
|
const cmsBytes = cms.toSchema().toBER(false);
|
|
return new Blob([cmsBytes], { type: 'application/pkcs7-mime; smime-type=enveloped-data' });
|
|
}
|
|
|
|
function deduplicateCerts(certs) {
|
|
const seen = new Set();
|
|
const result = [];
|
|
for (const cert of certs) {
|
|
const key = toHex(cert);
|
|
if (!seen.has(key)) {
|
|
seen.add(key);
|
|
result.push(cert);
|
|
}
|
|
}
|
|
return result;
|
|
}
|