Contao: The registration module re-sends activation mails

An attacker can make a site send unlimited activation emails to a chosen address, causing nuisance for the recipient and risking the site's mail reputation. The flaw also reveals whether an address has a pending registration. It requires a page containing the registration module, activation enabled via reg_activate, and an unconfirmed registration with tl_member.disable = 1 and an unconfirmed reg- opt-in token. An attacker can create that pending registration without proving ownership of the address.

Check composer.lock for contao/core-bundle at >= 4.1.0, < 5.3.50 or >= 5.4.0-RC1, < 5.7.12. If affected, check whether a page contains the registration module and whether reg_activate is enabled. The target state is tl_member.disable = 1 with an unconfirmed reg- opt-in token, but an attacker can create this state, so having no pending registrations now does not rule out exposure. Fixed versions are 5.3.50 and 5.7.12.

With reg_activate off, the vulnerable branch is unreachable.

ModuleRegistration::compile() reaches its follow-up registration branch on any POST to a page carrying the module. That branch checks neither FORM_SUBMIT nor the captcha result computed immediately above it, and resendActivationMail() leads to OptInToken::send(), which has no rate limit at all.

Impact

Anyone on the internet can make a Contao installation send unlimited mail to an address of their choosing, from the site's own sender and reputation, at one outbound message per HTTP request. That is both a nuisance for the recipient and a deliverability risk for the site operator. The same request is a reliable account oracle for "this address has a pending registration on this site", which is exactly the sort of membership fact a public site is usually expected not to disclose.

Honest bound. The target must have an unconfirmed registration, that is tl_member.disable = 1 together with an unconfirmed reg- opt-in token. An attacker can create that state for an arbitrary address, since registration requires no ownership proof, but on a site where reg_activate is off the branch is unreachable.