Email Vulnerability in OJS 3.3.0.13

[frhoff]

Describe the issue or problem
We got an Email from an “ethical hacker” with this content:

##################################
Hello Team,

I am an ethical hacker, bug bounty hunter and security researcher, I identify bugs in websites and provide vulnerability assessment of the identified issues.
I have found an email spoofing issue in your website which can allow anyone to send emails from “[diegesis@uni-wuppertal.de](javascript:void(window.open(‘/imp/dynamic.php?page=compose&to=diegesis%40uni-wuppertal.de&popup=1’,‘’,‘width=820,height=610,status=1,scrollbars=yes,resizable=yes’)))” to any other users. Please find the details of the bug below.
I am hoping to receive a bug bounty reward for the responsible disclosure of this issue and hope to report further bugs once this is pursued and remediated.

Vulnerability: DMARC Quarantine/Reject policy not enabled

I was able to send a forged email to my email address that appears to originate from “[diegesis@uni-wuppertal.de](javascript:void(window.open(‘/imp/dynamic.php?page=compose&to=diegesis%40uni-wuppertal.de&popup=1’,‘’,‘width=820,height=610,status=1,scrollbars=yes,resizable=yes’)))”. I was able to do this because of the following DMARC record:

Fix:

1)Enable DMARC Quarantine/Reject policy

2)Your DMARC record should look like

"v=DMARC1; p=reject; pct=100; ri=86400; rua=mailto:[info@domain.com](javascript:void(window.open(‘/imp/dynamic.php?page=compose&to=info%40domain.com&popup=1’,‘’,‘width=820,height=610,status=1,scrollbars=yes,resizable=yes’))) "
#################################

Is it a joke, phishing or something? Or is it a real warning?

Thank for any information and help

[asmecher]

Hi @frhoff,

Please don’t disclose potential security issues on the public forum; see ojs/SECURITY.md at main · pkp/ojs · GitHub for instructions. The message got garbled when you posted it here, so it’s hard to tell if the report is valid or perhaps a configuration issue outside of OJS. Please submit the issue to us via the instructions.

Thanks,
Alec Smecher
Public Knowledge Project Team

[asmecher]

Hi @frhoff,

Looking this over, it appears that it’s not related to OJS; the message is suggesting that your DMARC record, which is a function of your DNS / email delivery configuration, is not sufficiently stringent. For diligence I’d suggest reviewing the DMARC configuration with your ISP or institutional hosting resources. However, this doesn’t strike me as an especially urgent issue; anecdotally we are seeing an increase in these kinds of “ethical hacker” messages seeking bounties, and generally speaking they are unfortunately not very high quality reports.

Regards,
Alec Smecher
Public Knowledge Project Team