Security issue- Jobs email changed URL

Frappe Framework
1

Hi guys,

I was just checking my system and noticed s new ‘job applicant’ in the job area. The issue is when I clicked the email it modified my URL and broke my SSL. When I refreshed it would throw an error. I deleted the email to prevent any future issues. Not sure what happened but figured I should pass this type of threat along. The email also managed to change the URL of the nav bar to its own url.

I can provide more info if needed as I think this type of threat could be bad.

Here is a screenshot, you will notice the styling of the app itself is also different, as well as the SSL not being green.


Thanks

1 Like
2

My thoughts:

  • The change in styling could be because of the CSS in the HTML email
  • The padlock changed from green to gray because the image was loaded from an HTTP address.

@anand, should be block such things as default?

3

I don’t think this is a security issue. Since http images were loaded, it breaks the https logo - maybe we can ask before showing images.

4

Hi guys,

Thanks for looking into this. I agree the padlock probably changed due to the image not being secure, and the style changed from the CSS. The big concern with this email was how it changed the navbar URL on everything to its own URL. E.G Home was now http://candidatecare.com, same with the history and bookmark.

If you’d like I can forward the email to you for testing in the job application. I should still have it in the job email inbox on Google Apps.

Thanks for your thoughts and efforts on this.

Thanks for your continued support, please let me know if there is anything else I can do to help with this on my end.

Best,