we have been using the HubSpot integration (forms) for demo request,
we love HubSpot but recently some treat actors started using the platform to inject malicious code and sent malicious email to other users using the form
we trying to prevent this behaviour with notification (if you have not raised a request ignore this email)
Nonetheless, the forms have input validation issues; a malicious actor can inject HTML tags in names and other fields where there should never be space for those as they get interpreted.
for now we have a workaround via zapier to send all the emails but of course this is expensive and suboptimal
@SilvyaT it has to be done when you create the property, so you’d need to create custom properties and map them to the defaults with a workflow, but you can set form field validation rules to “don’t allow special characters” which will limit the ability to add code.
thanks for the update we’ll look into it, but wouldn’t those character of HTML script be disabled by default? those are dangerous script that have no place in a Name field?
@SilvyaT as I mentioned, you can’t add rules to existing fields. New custom fields would have to be created. Validation rules are new, so I’m not sure if that’s why it is limited to new fields only.
@SilvyaT not by default that I know of, but another option would be to add a honeypot - a hidden form field that human users can’t see, but bots do.
If the form submission includes a value in the hidden form field, you’ll know it’s spam (you can use a workflow to automate this).
Are you actively receiving form submissions with scripts or are you just testing?
I’ve had other users ask about this in the past, but have only seen fake tests go through, I’ve never seen a malicious script make it through - whether someone has tried is unknown, but that’s across hundreds of accounts.
You can prevent visitors with email addresses containing specific domains from submitting your HubSpot form or pop-up form. To further protect your forms from spam submissions, learn how to enable CAPTCHA on your forms.
Hi This will not work for sql injection or other attacks.
attackers can use the First and Last name to send email in a domain owner behalf to other users with injections or other things in the Name and last name like (click here) . is it possible to raise this with security?
Hi @SilvyaT as far as I’m aware, validation rules can’t be added to existing fields.
To add validation rules, you’d have to do the following:
1 - create a custom property (ex: “validated form first name”)
2 - create a workflow that triggers on form submission
2.a - the first step would be to copy the value from “validated form first name”
2.b - and set it for the default “first name” value
By creating the workflow, you can use the validated form fields in the background and have the default properties updated automatically. This same workflow could also filter out any spam submissions if you add a honeypot field (for bots that are submitting forms that don’t include a script or special character).
