Critical 0-Click Vulnerability Enables Attackers to Takeover Email Access Using Punycode
A critical zero-click vulnerability has been identified, allowing attackers to hijack online accounts by exploiting the handling of international email addresses by web applications.
A critical zero-click vulnerability has been identified, allowing attackers to hijack online accounts by exploiting the handling of international email addresses by web applications.
The vulnerability is rooted in a discrepancy known as a "canonicalization mismatch" and affects password reset and "magic link" login systems. This flaw allows attackers to gain control of an account by requesting a password reset with a specially crafted email address that appears identical to the victim's. The attack requires no interaction from the victim, making it particularly dangerous.
This method bypasses the need for phishing or malicious links. It involves the interplay between Unicode, which supports various characters in domain names (Internationalized Domain Names or IDN), and Punycode, which converts these characters into the standard ASCII format used by internet infrastructure.
Attackers can register domains using Unicode characters that resemble standard letters, such as a Cyrillic 'o' instead of a Latin 'o'. During a password reset request, if a web application's backend fails to distinguish between the legitimate and visually similar email addresses, the reset link may be sent to the attacker-controlled Punycode version of the domain.
The vulnerability is rooted in a discrepancy known as a "canonicalization mismatch" and affects password reset and "magic link" login systems.
This vulnerability is severe because it exploits a fundamental flaw in how applications process email addresses, relying on inconsistencies across application components. The result is that two visually identical addresses can be handled as different strings by mail systems.
Developers are advised to review and strengthen their authentication systems. Effective mitigation involves implementing consistent normalization of email addresses across system components, using robust validation libraries that understand Unicode confusables, and ensuring database lookups are not susceptible to visual tricks.
This vulnerability underscores the importance of understanding how seemingly simple data like an email address is processed and trusted within applications.
Based on reporting by Cyber Security News.