Description

A flaw has been found in simalexan api-lambda-send-email-ses up to bda6869aa81371d1e872242e74fe7d953edb818d. This issue affects the function SES.sendEmail of the file template.yml of the component API Gateway Endpoint. This manipulation of the argument toEmails/ccEmails/replyToEmails/subject/message causes missing authentication. It is possible to initiate the attack remotely. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-13T11:17:00.237Z",
  "pubdate": "2026-09-13T11:17:00.237Z",
  "executiveSummary": "The vulnerability identified in the simalexan api-lambda-send-email-ses repository involves a critical missing authentication flaw within the API Gateway Endpoint component.\nThis vulnerability allows unauthorized remote actors to interface with the SES.sendEmail function defined in template.yml.\nBy manipulating specific parameters, including toEmails, ccEmails, replyToEmails, subject, and message, an unauthenticated attacker can trigger unauthorized email dispatch via AWS SES.\nThe risk implication is significant as it facilitates unauthorized communication, potential spam propagation, or social engineering attacks leveraging the service's legitimate infrastructure.\nThe product utilizes a rolling release model, meaning no specific version identifiers are assigned to the affected or patched code; however, the flaw is present in all commits up to bda6869aa81371d1e872242e74fe7d953edb818d.\nSuccessful exploitation requires no prior authentication or elevated privileges, and the attack can be executed remotely over the network.",
  "technicalDetails": "The vulnerability resides in the configuration of the API Gateway Endpoint managed via the template.yml file. The root cause is a failure to implement proper authorization controls or AWS IAM policies on the API Gateway resource that invokes the Lambda function responsible for sending emails.\nIn the context of the AWS Serverless Application Model (SAM) or CloudFormation templates, the API Gateway configuration lacks the 'Auth' property or an associated Lambda Authorizer, leaving the endpoint publicly accessible to any client capable of sending an HTTP request.\nThe exploitation flow begins with the attacker identifying the public endpoint URL associated with the deployment. Because the backend Lambda function SES.sendEmail performs no internal validation to ensure the requester is authorized to send emails, it blindly accepts input parameters from the HTTP request body or query string.\nAn attacker can craft a malicious HTTP request targeting the API Gateway endpoint. By injecting arbitrary data into the 'toEmails', 'ccEmails', 'replyToEmails', 'subject', or 'message' fields, the attacker forces the underlying Lambda execution environment to interface with the AWS Simple Email Service (SES) API using the function's assigned execution role.\nSince the Lambda function is inherently trusted by the AWS environment, it provides the attacker with a conduit to send arbitrary emails. The impact of this post-exploitation behavior includes the ability to send phishing content, distribute malware via links, or engage in reputation-damaging mass-mailing activities that appear to originate from the organization's verified SES identity.\nThe attack is characterized as a 'Missing Authentication' flaw (CWE-306). Because the endpoint lacks a mechanism to verify the identity of the caller (such as API keys, Cognito user pools, or IAM signature version 4), the endpoint remains exposed to the public internet without defensive barriers. There is no requirement for the attacker to possess an account, specific credentials, or session tokens to successfully execute the SES.sendEmail operation.\nGiven that the project uses a rolling release model, the vulnerability is inherent to the lack of explicit security definitions in the infrastructure-as-code template. The exposure persists until the template.yml is modified to enforce strict authorization protocols on the API Gateway definition."
}