Email Injection in Adonisjs
How Email Injection Manifests in Adonisjs
Email injection in Adonisjs applications typically occurs when user input is directly used in email headers without proper sanitization. The framework's email service, built on Nodemailer, can be vulnerable when developers dynamically construct email headers or pass user input to the send method without validation.
A common Adonisjs-specific pattern involves using the Mail facade with user-provided data:
const { name, email, message } = request.post()
await Mail.send('emails.contact', { name, message }, (message) => {
message.to(email)
message.from('[email protected]')
message.subject(`Contact from ${name}`)
message.replyTo(email)
})The vulnerability appears when name or email contains newline characters. An attacker could inject additional headers like BCC or CC by submitting:
name: "John Doe\nBCC: [email protected]"
email: "[email protected]"This would cause the email to be sent to both the intended recipient and the victim, enabling spam distribution or phishing campaigns using your server's reputation.
Another Adonisjs-specific scenario involves the Mail.raw method when constructing emails programmatically:
const emailContent = request.input('email_content')
await Mail.raw(emailContent, (message) => {
message.to('[email protected]')
message.subject('User Feedback')
})If email_content contains CRLF sequences, attackers can inject arbitrary email headers or even multipart content, potentially bypassing spam filters or embedding malicious content.
Adonisjs's validation system, while robust, can miss these issues if developers don't explicitly validate for newline characters. The default string validation doesn't check for \r or \n characters:
const schema = schema.create({
name: schema.string(),
email: schema.string(),
message: schema.string()This schema would accept malicious input containing newline characters, leading to header injection when the data reaches the email service.
Adonisjs-Specific Detection
Detecting email injection in Adonisjs applications requires examining both the code patterns and runtime behavior. Using middleBrick's API security scanner, you can identify vulnerable email handling patterns without modifying your application.
middleBrick scans for email injection by analyzing your API endpoints for patterns like:
POST /api/contact
Headers: Content-Type: application/json
Body: {"name":"attacker","email":"[email protected]","message":"test"}The scanner tests for newline character injection by sending payloads containing \r\n sequences and monitoring the application's response. If the application processes these characters without sanitization, it indicates a vulnerability.
For Adonisjs applications, middleBrick specifically checks:
- Mail facade usage with dynamic header construction
- Controller methods that accept email-related parameters without sanitization
- Validation schemas that don't explicitly check for newline characters
- Raw email content that might contain user input
- Dynamic subject line construction using user data
The scanner also examines your OpenAPI/Swagger specifications if available, looking for email-related endpoints that accept user input. It cross-references these specifications with actual runtime behavior to identify discrepancies between documented and implemented security controls.
middleBrick's LLM/AI security module adds another layer of detection for AI-powered email features. If your Adonisjs application uses AI for email generation or analysis, the scanner tests for:
- System prompt leakage in email processing
- Prompt injection attempts through email content
- Excessive agency in email automation
The scanning process takes 5-15 seconds and provides a security score with specific findings. For email injection, you'll receive detailed information about vulnerable endpoints, the exact line numbers in your controllers, and remediation guidance tailored to Adonisjs's conventions.
Adonisjs-Specific Remediation
Fixing email injection in Adonisjs requires a multi-layered approach using the framework's built-in features. The most effective solution combines strict validation with safe email construction patterns.
First, implement comprehensive validation that explicitly checks for newline characters:
const { schema } = use('@adonisjs/validator')
const emailSchema = schema.create({
name: schema.string({}, [
rules.blacklist(["\r", "\n"]),
rules.maxLength(100)
]),
email: schema.string({}, [
rules.email(),
rules.blacklist(["\r", "\n"])
]),
message: schema.string({}, [
rules.maxLength(1000),
rules.blacklist(["\r", "\n", "Content-Type:", "MIME-Version:", "Content-Transfer-Encoding:"])
])The rules.blacklist ensures that newline characters and other dangerous strings are rejected before they reach your email service. This validation should be applied to all email-related input parameters.
For email construction, use Adonisjs's Mail builder with explicit parameter binding rather than string interpolation:
const contactSchema = await request.validate({ schema: emailSchema })
await Mail.send('emails.contact', { contact: contactSchema }, (message) => {
message.to('[email protected]')
message.from('[email protected]')
message.subject(`Contact from ${contactSchema.name}`)
message.replyTo(contactSchema.email)
})This approach ensures that user input is treated as data rather than executable header content. For dynamic subject lines, always use template literals with sanitized variables rather than concatenating raw user input.
When using Mail.raw or programmatic email construction, implement a sanitization layer:
function sanitizeEmailInput(input) {
return input.replace(/[\r\n]/g, '').trim()
}
const sanitizedContent = sanitizeEmailInput(request.input('email_content'))
await Mail.raw(sanitizedContent, (message) => {
message.to('[email protected]')
message.subject('User Feedback')
})For applications with AI-powered email features, implement additional safeguards:
const aiSchema = schema.create({
prompt: schema.string({}, [
rules.maxLength(1000),
rules.blacklist(["\r", "\n", "system:", ":::"])
])
})
// Use middleBrick's MCP server to scan AI email endpoints
const { execSync } = require('child_process')
execSync('middlebrick scan https://yourapi.com/ai-email --format=json')This comprehensive approach ensures that email injection vulnerabilities are eliminated through proper validation, safe construction patterns, and runtime scanning with middleBrick.
Frequently Asked Questions
Can email injection occur through Adonisjs's validation system?
schema.string() validation accepts any character, including \r and \n. You must add rules.blacklist(["\r", "\n"]) to prevent header injection through validation bypasses.