[GH-ISSUE #416] Security: visual spoofing of email (address, name), attachment name, etc. #346

New issue

Open

opened 2026-02-25 21:34:48 +03:00 by kerem · 4 comments

kerem commented

2026-02-25 21:34:48 +03:00

Owner

Originally created by @dumblob on GitHub (Jul 29, 2020).
Original GitHub issue: https://github.com/cypht-org/cypht/issues/416

Originally assigned to: @jasonmunro on GitHub.

🗣 Suggestion

Current severe issues making it impossible to visually detect there is something wrong with the contents you're dealing with:

https://www.virtuesecurity.com/pentesting-user-interfaces/

Note, I didn't test this in Cypht, but I think there could be some more countermeasures implemented 😉.

Originally created by @dumblob on GitHub (Jul 29, 2020). Original GitHub issue: https://github.com/cypht-org/cypht/issues/416 Originally assigned to: @jasonmunro on GitHub. ## 🗣 Suggestion Current severe issues making it impossible to visually detect there is something wrong with the contents you're dealing with: https://www.virtuesecurity.com/pentesting-user-interfaces/ Note, I didn't test this in Cypht, but I think there could be some more countermeasures implemented :wink:.

kerem added the

enhancement

Security

research

labels

2026-02-25 21:34:48 +03:00

kerem commented

2026-02-25 21:34:48 +03:00

Author

Owner

@jasonmunro commented on GitHub (Jul 29, 2020):

I think we are safe from some of this, but I am definitely going to test it out :)

@jasonmunro commented on GitHub (Jul 29, 2020): I think we are safe from some of this, but I am definitely going to test it out :)

kerem commented

2026-02-25 21:34:49 +03:00

Author

Owner

@marclaporte commented on GitHub (Jul 31, 2022):

@dumblob Any chance you could do a quick test?

@marclaporte commented on GitHub (Jul 31, 2022): @dumblob Any chance you could do a quick test?

kerem commented

2026-02-25 21:34:49 +03:00

Author

Owner

@dumblob commented on GitHub (Nov 7, 2022):

No time now to set up a current Cypht version. But let us fill the following table first:

particular visual spoofing	permalink to source code line(s) dealing with it
URLs in email bodies (both in plain text and HTML)	MISSING
attachment names	MISSING
email addresses "everywhere" (in email headers, bodies, etc.)	MISSING
RTL/LTR domains	MISSING

@dumblob commented on GitHub (Nov 7, 2022): No time now to set up a current Cypht version. But let us fill the following table first: particular visual spoofing | permalink to source code line(s) dealing with it --- | --- URLs in email bodies (both in plain text and HTML) | **MISSING** attachment names | **MISSING** email addresses "everywhere" (in email headers, bodies, etc.) | **MISSING** RTL/LTR domains | **MISSING**

kerem commented

2026-02-25 21:34:49 +03:00

Author

Owner

@marclaporte commented on GitHub (May 7, 2024):

@dumblob

Please retest, as a lot has changed since you reported this issue. Notably, we now have 3 active branches and recently released Cypht 2.0.0

@marclaporte commented on GitHub (May 7, 2024): @dumblob Please retest, as a lot has changed since you reported this issue. Notably, we now have 3 active branches and recently released Cypht 2.0.0 - https://github.com/cypht-org/cypht/releases/tag/v2.0.0 - https://github.com/cypht-org/cypht/wiki/Lifecycle

kerem referenced this issue

2026-02-25 21:36:14 +03:00

[PR #346] [MERGED] fix compose page handler module precedence #788