[Yun Tianming] backend/src/services/email/smtp-config.service.ts: private-IP SMTP host check fails open when DNS does not resolve #2178

Location: backend/src/services/email/smtp-config.service.ts:362-380 (validateSmtpHost).

Kind: SSRF guard bypass.

Evidence: the check uses dns.resolve4/resolve6(...).catch(() => []). These query DNS servers directly and ignore /etc/hosts and NSS, so a name like localhost or any hosts-file alias resolves to [], privateAddr is undefined, and validation passes. verifySmtpConnection (line 399) then hands the host to nodemailer, which uses getaddrinfo and does honour /etc/hosts, so the connection goes to 127.0.0.1. The comment at line 379 ("DNS resolution failure is fine — transporter.verify() will catch it") describes a guarantee that does not hold. There is also a resolve-then-connect TOCTOU window.

Impact: the SMTP allowlist can be bypassed to make the backend open TCP connections and send credentials to loopback/private services.

Fix would touch: validateSmtpHost (use dns.lookup or treat an empty resolution as a rejection, and/or validate at connect time), and tests/unit/smtp-security.test.ts, which currently tests isPrivateIp only.

Found by Yun Tianming: nightly sweep 2026-10-29-1300 at 21ce31dd8fb3. A security finding: reported, never fixed here, because tightening changes what the product accepts.

🤖 Generated with Claude Code