Summary
A Null Byte (%00) Email Injection vulnerability was identified during testing of the signup functionality on the following endpoint:
Target URL:
https:
The application accepts a null byte (%00) within the email address during input validation instead of rejecting it. Improper handling of null bytes can lead to inconsistent email parsing between application components, resulting in authentication issues, account confusion, duplicate account creation, or potential security bypasses.
Vulnerability Details
The signup form fails to properly sanitize or reject null byte characters embedded within the email address.
Payload Used
mitha+1%00@gmail.com
Depending on how the application, backend services, databases, or third-party email libraries process this input, the null byte may be:
Truncated during processing.
Ignored by certain components.
Stored differently than validated.
Normalized inconsistently.
Interpreted differently across backend services.
This inconsistency can create unexpected security issues.
Steps to Reproduce
Navigate to:
https:
Enter the following email address:
mitha+1%00@gmail.com
Complete the remaining required signup fields.
Submit the registration form.
Observe that the application accepts the email instead of rejecting it as invalid.
Expected Result
The application should:
Reject email addresses containing null byte characters (%00).
Validate email input according to RFC-compliant email rules.
Normalize and sanitize email input before processing.
Return an appropriate validation error.
Actual Result
The application accepts an email address containing a null byte, indicating insufficient input validation.
Security Impact
If different backend components interpret the email differently, an attacker may be able to:
Create ambiguous or duplicate accounts.
Trigger inconsistent email validation between frontend and backend.
Bypass uniqueness checks for email addresses.
Cause email verification to be sent to an unintended address.
Exploit parser inconsistencies in authentication or password reset workflows.
Abuse integrations with third-party identity providers or email services that normalize the input differently.
Facilitate account confusion or account takeover scenarios if truncation or normalization maps the malicious input to another user's email.
The severity depends on how the application stores, normalizes, and uses the email address after registration.
Business Impact
Successful exploitation may lead to:
Registration of malformed user accounts.
Authentication inconsistencies.
Duplicate or conflicting user identities.
Increased risk of account recovery issues.
Potential account takeover if email parsing differs across systems.
User confusion and additional support overhead.
Loss of trust in the platform's account management process.
Proof of Concept
Endpoint
https:
Injected Email
mitha+1%00@gmail.com
Observed Behavior
The application accepted the email containing a null byte instead of rejecting it during validation.
Remediation
Reject null byte characters (%00) during input validation.
Canonicalize and normalize email addresses before validation and storage.
Ensure consistent email parsing across all application layers and third-party services.
Apply strict server-side validation regardless of client-side checks.
Validate email addresses using well-maintained libraries that reject invalid control characters.
Ensure uniqueness checks are performed on the normalized email value.
CWE
CWE-20: Improper Input Validation
CWE-184: Incomplete List of Disallowed Inputs (where applicable)
CVSS v3.1
Base Score: 5.3 (Medium)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Note: If the null byte injection can be demonstrated to bypass email uniqueness, affect password reset, or enable account takeover, the severity should be raised to High with a correspondingly higher CVSS score.