bscott/subtrackr v0.6.11

v0.6.11 - Password reset and email header security fixes

on GitHub

Security Fix

Password reset link poisoning

When no Base URL was configured, the unauthenticated forgot-password endpoint built the emailed reset link from the request's Host and X-Forwarded-Host headers. Anyone who could reach SubTrackr could send a reset request with a forged host. The administrator would then receive a genuine reset email whose link sent the reset token to the attacker's domain. Clicking it could lead to account takeover.

Affected installations: local password authentication with SMTP configured and no Base URL set. Installations with a Base URL configured were not affected.

Fix: the reset email no longer uses request headers.

• With a Base URL configured, the email contains a direct link built from that setting.
• Without one, the email contains the site-relative path (/reset-password?token=…) to open on your own SubTrackr address. Setting a Base URL in Settings restores the one-click link.

Credit: reported by Maxim (MaxKUlish1), independent security researcher. Thank you for the responsible disclosure.

Email header injection through notification subjects

Subscription names appear in notification email subjects. A name containing line breaks, which anyone with an API key could set, could inject email headers or replace the content of notification emails sent to the administrator. Header values are now stripped of line breaks and encoded. As a side benefit, subjects with non-ASCII names (for example "Café") now display correctly in all mail clients.

Related hardening

• SMTP errors from a failed reset email are now written to the server log rather than shown to unauthenticated visitors, since they could reveal internal mail server addresses.
• A forgot-password request that cannot send email (SMTP not configured) no longer replaces an outstanding reset token.

Recommended action

Upgrade to v0.6.11. If you run SubTrackr behind a reverse proxy, also set Settings → Base URL to your public address.

Technical Changes

• SendEmail builds messages through buildEmailMessage, which strips line breaks from header values and RFC 2047 encodes the subject and sender name.
• ForgotPassword builds the link only from the configured Base URL (passwordResetEmailBody), never via buildBaseURL.
• The reset email HTML-escapes the link.
• The auth handler depends on a one-method emailSender interface for testability.
• New tests send forged Host, X-Forwarded-Host, Forwarded, and X-Original-Host headers and verify the email never contains the attacker host and that the emailed token still validates.