# Bypass auth.email-domains

Phabricator didn't length-check emails before storing in VARCHAR(128), so a 128-char attacker email plus @allowed-domain.com got truncated, bypassing auth.email-domains and granting registration.

- Payout: $1,000
- Severity: medium
- Program: Phabricator
- Credited: tomvg
- Disclosed: 2014-03-25
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/2224
- Library page: https://bugbountylibrary.com/r/h1%3A2224
- Tags: domain:web impact:internal-access kind:bounty platform:hackerone sev:medium tech:php technique:source-review vuln:access-control vuln:auth-bypass

**Target:** Registration email validation / auth.email-domains allowlist
**Root cause:** Email stored as VARCHAR(128) without length validation; MySQL truncates the appended allowed-domain suffix, so the stored value passes the domain allowlist check while the verification email goes to the attacker's real address.
**Steps:**
1. Register with an email of exactly 128 chars (e.g. `attacker+aaaa...aaa@gmail.com` padded to 128) followed by `@allowed-domain.com`.
2. Submit registration; Phabricator checks the domain suffix against `auth.email-domains` and accepts.
3. MySQL truncates the value to 128 chars, dropping `@allowed-domain.com`.
4. Verification email is delivered to the attacker's real Gmail (plus-addressing), completing registration.
**How found:** Noticed email column is VARCHAR(128) while RFC max is 254; hypothesized truncation could strip the appended allowed-domain suffix and bypass the allowlist check.
**Exploitation:** Attacker with any email (Gmail plus-addressing) crafts a 128-char local part, appends an allowed domain, registers, receives verification at their real inbox, and gains an account on an instance restricted to specific email domains.
**Insight:** When an allowlist check runs on a string that is later truncated by a fixed-width DB column, pad the string so the trusted suffix is the part that gets cut—test length boundaries against storage limits, not just validation regexes.