[Bug]: Unauthenticated email relay on task invite/funding/report #1624

Contact Details

alnaeem961@gmail.com

What happened?

Severity: Medium
CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N → 5.3
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling), CWE-183 (Permissive List of Allowed Inputs)
Affected versions: All versions (master @ ab67c6d)
Patched versions: None
Affected products: worknenjoy/gitpay — backend (src/)

Summary
Three task routes are registered before the secure middleware and therefore require no authentication. Each one sends email through the platform's SendGrid identity to a recipient and with content supplied by the caller. There is no rate limit. This lets an unauthenticated attacker use Gitpay as an email relay for phishing or spam that appears to originate from Gitpay, or to flood any mailbox.

Affected code
src/app/routes/tasks.ts:12-14 (all before router.use(secure))
12: router.post('/:id/invite/', controllers.inviteUserToTask)
13: router.post('/:id/funding/', controllers.inviteToFundingTask)
14: router.post('/:id/report', controllers.reportTask)
​
src/modules/tasks/taskInvite.ts — sends to body.email with body.name / body.message and the task's title/URL.
src/modules/tasks/taskFunding.ts — sends to body.email with body.comment, suggestedValue, username.
src/modules/tasks/taskReport.ts — builds an approval URL containing jwt.sign(task.id, SECRET_PHRASE) and emails it to the internal report address, using body.baseUrl, task.title, and body.reason.

Proof of concept
Runnable PoC: poc/09-unauthenticated-email-relay.js

POST /tasks/1/invite/ HTTP/1.1
Host:
Content-Type: application/json

{
"email": "attacker-controlled@example.com",
"name": "Gitpay Security",
"message": "Verify your account at https://attacker.example/login"
}
​
No Authorization header is required. The platform sends the email to the supplied address with the attacker's text, wrapped in Gitpay branding and a link to the task.
The same applies to:
POST /tasks/1/funding/
Content-Type: application/json

{"email":"victim@example.com","comment":"...","suggestedValue":"...","username":"..."}
​
Expected: authentication required; recipient fixed to the registered user; rate limiting.
Actual: unauthenticated send to an arbitrary address.

Impact
Gitpay's verified sending domain is used to deliver attacker-controlled content to arbitrary recipients (phishing/spam), and any address can be mailbox-flooded. The taskReport endpoint also lets an unauthenticated caller generate report emails containing signed task-deletion links.

Workarounds / Remediation
Move all three routes behind secure. Require the caller to own the task for invite/funding. Never take the recipient address from the client for invite/funding; send to the registered user's email. Add per-IP and per-account rate limits. For report, rate-limit and ignore client-supplied baseUrl.

References

regards
Alwoares

09-unauthenticated-email-relay.js

What browsers are you seeing the problem on?

Chrome

Relevant log output

💰 Is there a bounty for this issue?

Yes

💵 Bounty Amount (if any)

No response

📜 Bounty Details (if applicable)

No response