Nodemailer SSRF and Arbitrary File Read Vulnerability

Nodemailer versions prior to 9.0.1 contain a security oversight where the 'disableFileAccess' and 'disableUrlAccess' flags are not properly applied when processing message-level 'raw' options. This flaw allows an authenticated attacker to provide malicious path or href properties within the email structure. By exploiting this, an attacker can coerce the server into performing server-side request forgery (SSRF) to interact with internal resources or to read arbitrary files from the filesystem. The contents of these files or the response from the internal requests are then exfiltrated to an attacker-controlled recipient via the outgoing email message. This vulnerability poses a significant risk to applications using Nodemailer to process user-supplied email content or templates, as it bypasses intended security sandbox restrictions.

Impact

Successful exploitation allows authenticated users to exfiltrate sensitive internal configuration files, credentials, or metadata via email. It also facilitates SSRF, enabling attackers to probe internal network services and sensitive APIs that are not exposed to the public internet, potentially leading to further compromise of the internal environment.

Recommendation

Update Nodemailer to version 9.0.1 or later immediately to ensure that 'disableFileAccess' and 'disableUrlAccess' flags are correctly enforced during message processing.