swoosh has email-derived URL path injection in Microsoft Graph endpoint

影響: erlang:swoosh >= 1.12.0, < 1.26.3 → 1.26.3 Summary Swoosh.Adapters.MsGraph builds its Microsoft Graph API request URL by interpolating the sender's email address directly into the URL path (/users/{from}/sendMail) without percent-encoding or validation. In applications that derive the from address from untrusted or user-influenced input (a relay, a contact form, or a "send as" feature), an attacker can inject URL-special characters into the local part of the address to escape the intended path segment and rewrite the request's path and…

GitHub Advisory Databaseで読む