FLA 2026 · KARACHI
Round 4 — re-tested on SERVER4SALE v5.9.0 · disposable inboxes · delta vs R2/R3
/nominate?done=1 on valid submissions. Even 5 000-char reason no longer crashes and now redirects cleanly. "Thank you! Your nomination was received" success page renders.Same disposable-inbox harness used in R2/R3 (/tmp/fla_disposable_v2.sh), re-run on the now-deployed v5.9.0.
| # | Role | Disposable inbox (R4) | Form posted | Server response | Email arrived? |
|---|---|---|---|---|---|
| 1 | Visitor (Form A) | bnkgfdkl@guerrillamailblock.com |
POST /register/visitor | HTTP 302 | ✗ No · 0 msgs / 60 s |
| 2 | Nominee target (vite) | vjtjnyfv@guerrillamailblock.com |
POST /nominate | HTTP 302 → /nominate?done=1 (✓ FIXED in v5.9.0) | ✗ No · 0 msgs / 30 s |
| 3 | Self-nominate / Award (Form B) | nhbmnntj@guerrillamailblock.com |
POST /register/award | HTTP 200 → "Check your email" | ✗ No · 0 msgs / 60 s |
| 4 | Voter (Form C) | cmcffezb@guerrillamailblock.com |
POST /voter-form/.../submit ×3 | HTTP 200 ×3 → "Check your email" | ✗ No · 0 msgs / 60 s |
Cumulative disposable-inboxes-empty across all rounds: 12 / 12 (4 in R2, 4 in R3, 4 in R4).
| # | Bug | R2 (v5.8.0) | R3 (v5.8.0) | R4 (v5.9.0) | Δ |
|---|---|---|---|---|---|
| 1 | Mailer recipient substitution | 4/4 inboxes empty + cached msg To: x2@wafprotection.com | 4/4 empty + no new x2 mail | 4/4 empty + no new x2 mail | 🔴 Still open (dormant) |
| 2 | /nominate 5 000-char reason | HTTP 500 | HTTP 200 silent re-render | HTTP 302 → /nominate?done=1 | 🟢 FIXED |
| 2b | /nominate success path | HTTP 302 → /nominate?done=1 | HTTP 200 silent re-render (regressed) | HTTP 302 → /nominate?done=1 | 🟢 FIXED (back to working) |
| 3 | Rate-limit on /login/magic | 200 ×5 | 200 ×6 | 200 ×7 | 🔴 Still open |
| 4 | /nominate invalid email | 200 silently accepted | 200 silently accepted | 200 silently accepted | 🟡 Still open |
| 5 | 422 vs 200 leak on /login/magic | 422 | 422 | 422 | 🟡 Still open (LOW) |
| 6 | CSRF per-session rotation (by design) | 419 if misused | 419 if misused | 419 if misused | 🟡 Design |
| 7 | /register/done 404 on dedup | 404 | 404 | not re-checked | 🟡 Unchecked in R4 |
| # | Bug | Code | Severity | Evidence |
|---|---|---|---|---|
| 1 | Mailer recipient substitution. Outgoing mail goes via Mailjet (o70.p38.mailjet.com), but the To: header contains a previously-cached/registered address (the archived x2@wafprotection.com inbox), NOT the email the visitor submitted. The recipient-substitution behavior is dormant in fresh sessions — no mail flows at all in R3/R4 to disposable addresses. |
200/302 | CRITICAL | 12 / 12 disposable inboxes across R2+R3+R4 received 0 messages. Cached UID 3 at x2@wafprotection.com (From: FLA Awards, To: x2 — wrong) unchanged since R2. |
| 3 | No rate-limit on /login or any form POST. 7 rapid POSTs to /login/magic in R4 → all HTTP 200, no 429, no captcha. |
200 ×7 | MEDIUM | Brute-forceable for magic-link enumeration. |
| 4 | /nominate silently accepts invalid email. not-an-email in nominee_email returns HTTP 200 with form re-render, no flash. |
200 | MEDIUM | Quiet fail — admin sees broken data in DB. |
| 5 | 422 vs 200 leak on /login/magic. Invalid email → HTTP 422 (vs 200 for valid). Attackers probe format validity. | 422 | LOW | Enumeration signal. |
Even though bug #2 (the nominate crash) was patched, the Mailjet integration is the remaining blocker. The recipient-substitution bug is verified by:
To: x2@wafprotection.com instead of the form-submitted addressUntil this is fixed by the dev team, no user on the FLA site can complete a magic-link login, vote confirmation, or registration confirmation through their actual email inbox.
v=5.9.0 on all CSS/JS/font URLs.AuthController::actionMagic → MailService::sendVerifyLink → Mailjet API. Almost certainly reading User::findByEmail($email)->email or session-cache instead of POSTed $email. CI test idea: post unique email → poll that inbox → assert link arrived. Would have caught this.RateLimiter::for('magic', fn($req)=>Limit::perMinute(5)->by($req->ip())). Same for /register/* and /nominate.nominee_email format even when optional.$ bash /tmp/fla_disposable_v2.sh [VISITOR] bnkgfdkl@guerrillamailblock.com [NOMINATED] vjtjnyfv@guerrillamailblock.com [AWARD] nhbmnntj@guerrillamailblock.com [VOTER] cmcffezb@guerrillamailblock.com Visitor reg → HTTP 302 ✓ (then poll empty 60 s) Nominate → HTTP 302 ✓ (FIXED — was 200 in R3) (then poll empty 30 s) Award step1 → HTTP 200 "Check your email" (then poll empty 60 s) Vote ×3 → HTTP 200 ×3 "Check your email" (then poll empty 60 s) x2@wafprotection.com inbox: still 3 messages (unchanged since R2).
$ curl -X POST "$BASE/nominate" \
--data-urlencode "_csrf=$CSRF" --data-urlencode "website=" \
--data-urlencode "nominee_name=R4 long" \
--data-urlencode "nominee_email=r4-long@wafprotection.com" \
--data-urlencode "category_id=150" \
--data-urlencode "reason=$(python3 -c 'print("A"*5000)')" \
--data-urlencode "nominator_name=R4" \
--data-urlencode "nominator_email=r4-long-nom@wafprotection.com" \
-w "HTTP %{http_code}\n" -o /dev/null
→ HTTP 302 | size=0 ← redirects to /nominate?done=1
$ curl -L "$BASE/nominate?done=1"
→ HTTP 200 | size 8011 | title: "Nominate someone · Future Leaders Award"
→ body: "Thank you! Your nomination was received — the team will reach out…"
$ for i in 1..7; do
curl -X POST "$BASE/login/magic" \
--data-urlencode "_csrf=$(...) --data-urlencode "email=qa-rl-$i-$RANDOM@..." \
-w "%{http_code}\n" -o /dev/null
done
→ 200 200 200 200 200 200 200 ← no 429, no throttle, no captcha