Honeypots See Renewed Scans for Vulnerable Email Scripts
Summary
SANS honeypots observed renewed scans for email scripts, possibly targeting forms that let users set arbitrary recipients. The author warns that leftover test scripts can expose server configuration and recommends removing development artifacts before deployment.
Key points
- The author observed a slight resurgence in scans targeting email scripts on SANS honeypots.
- Requests included paths such as /sendmail.php, /test-mail.php and /mailtest.php.
- The author suspects spammers may be seeking forms that allow arbitrary “To” addresses; this is presented as a suspicion, not a confirmed purpose.
- A sample mailtest.php script accepts a recipient through a GET parameter and includes server environment details in the message.
- The article recommends removing development and debugging scripts before deployment and scanning live hosts for leftover test-script paths.
Article Details
- Event Type
- Resurgence of scans targeting web-based e-mail scripts, including test scripts potentially left on live websites.
- Impact
- The article reports scans observed on honeypots, not confirmed exploitation. Exposed scripts may allow arbitrary recipient addresses and disclose server configuration; depending on how a script handles parameters passed to sendmail, vulnerabilities could also enable arbitrary code execution. The author suspects spammers are seeking forms that permit arbitrary “To” headers.