[nextcloud/mail] Blind SSRF to Internal Network via "List-Unsubscribe" SMTP Header when allow_local_remote_servers is allowed

Summary

We consider this a non-issue due to the nature of the developer configuration flag allow_local_remote_servers being here exactly for that case. For developers it's necessary to test with local servers, so when this flag is allowed of course the "internal SSRF" works. If the configuration is not set or set to false as it should be on any production server, no SSRF is possible.

This issue was reported in the course of broader research on the “List-Unsubscribe” SMTP header.

While, in my test environment, the SSRF could be used to target internal hosts, later evaluation led to the conclusion that Nextcloud sufficiently protects against internal SSRF via the "List-Unsubscribe" SMTP header. Still, the approach described in my blog post can be used to forge external requests. Insecure Nextcloud configurations or additional supporting factors may also allow requests to internal networks via this SSRF.

The blog post discussing vulnerabilities in this domain can be found here: https://security.lauritz-holtmann.de/post/xss-ssrf-list-unsubscribe/