Horizon Alert
Summary of the vulnerability and why it matters
A critical vulnerability in the `boring-tls` integration of the `lettre` email library for Rust could allow an attacker to intercept email credentials and content. This issue arises from a flaw in TLS hostname verification, which, when using default settings, is silently disabled, potentially exposing sensitive information transmitted via SMTP. While other TLS backends are unaffected, this vulnerability could impact applications built with the `boring-tls` feature.
- Email credentials and content may be exposed.
- Confirms a flaw in how some applications verify email connections.
- Focus on confirming relevance and exposure of affected applications.
Attack Path
How an attacker could exploit the issue
An attacker on the same network could exploit this vulnerability by intercepting network traffic. This is possible because a flaw in the `boring-tls` integration silently bypasses TLS hostname verification when using the default strict settings in the `lettre` mailer library. If an attacker can trick a user into accepting a forged certificate, they can then read and modify email submissions, including login credentials.
- Attacker on the same network.
- Intercepts SMTP traffic.
- Leads to credential and content theft.
Live Threat
Current exploitation, exposure, and threat context
When supported by the advisory, an on-path attacker could intercept SMTP submission traffic sent by applications using a specific Rust mailer library. This interception could expose plain-text credentials and message contents if the `boring-tls` integration is used and its TLS hostname verification is bypassed.
- User credentials and message content.
- Via attacker-controlled network traffic.
- Exposure of sensitive communication data.
Operational Fix
Recommended remediation, mitigation, and detection steps
This vulnerability affects applications built with the lettre mailer library using the `boring-tls` integration. Application owners or the development teams responsible for these applications should investigate their use of lettre, specifically if the `boring-tls` feature is enabled. The first practical step is to identify all applications that use lettre with `boring-tls`, determine if they handle sensitive information during SMTP submission, and confirm the version of lettre in use.
- Application owners should own the issue.
- Verify lettre usage and `boring-tls` integration.
- Update lettre to a patched version.
