SECURITY ISSUE - Forms seems to be subject to input validation issue

[SilvyaT]

Hi,

we have been using the HubSpot integration (forms) for demo request,

we love HubSpot but recently some treat actors started using the platform to inject malicious code and sent malicious email to other users using the form

we trying to prevent this behaviour with notification (if you have not raised a request ignore this email) 

Nonetheless, the forms have input validation issues; a malicious actor can inject HTML tags in names and other fields where there should never be space for those as they get interpreted.

for now we have a workaround via zapier to send all the emails but of course this is expensive and suboptimal 

[SilvyaT]

add validation rules and replace the field with new field? can validation rule be added to default fields? 

[Jnix284 · Accepted solution]

Hi @SilvyaT as far as I'm aware, validation rules can't be added to existing fields.

To add validation rules, you'd have to do the following:

1 - create a custom property (ex: "validated form first name")

2 - create a workflow that triggers on form submission

2.a - the first step would be to copy the value from "validated form first name"

2.b - and set it for the default "first name" value

By creating the workflow, you can use the validated form fields in the background and have the default properties updated automatically. This same workflow could also filter out any spam submissions if you add a honeypot field (for bots that are submitting forms that don't include a script or special character).

[PamCotton]

Hello @SilvyaT, Happy Monday!

Thank you for posting in our Community!

 Are you currently using the Block free email providers feature in a HubSpot form? There is also a feature that allows you to block form or pop-up form submissions from specific email domains. ( More information here).

You can prevent visitors with email addresses containing specific domains from submitting your HubSpot form or pop-up form. To further protect your forms from spam submissions, learn how to enable CAPTCHA on your forms. 

To our top experts, @Jnix284, @JustinPerkinsC @Jigar_Thakker any recommendations or workarounds to @SilvyaT?

Thank you,

Pam

[SilvyaT]

Hi This will not work for sql injection or other attacks.

attackers can use the First and Last name to send email in a domain owner behalf to other users with injections or other things in the Name and last name like (click here) . is it possible to raise this with security? 

[SilvyaT]

Find below some example of the fields with injection potential (example <h1> to modify the font)

The formthe email outputdomain validation passed (from a user)injection in fieldsfilter in zapierno way to filter in hubspot

[Jnix284]

@SilvyaT it has to be done when you create the property, so you'd need to create custom properties and map them to the defaults with a workflow, but you can set form field validation rules to "don't allow special characters" which will limit the ability to add code.

this knowledge base article has more info about form spam management

[SilvyaT]

Hi Jennifer

thanks for the update we'll look into it, but wouldn't those character of HTML script be disabled by default? those are dangerous script that have no place in a Name field? 

[Jnix284]

@SilvyaT not by default that I know of, but another option would be to add a honeypot - a hidden form field that human users can't see, but bots do.

If the form submission includes a value in the hidden form field, you'll know it's spam (you can use a workflow to automate this).

Are you actively receiving form submissions with scripts or are you just testing?

I've had other users ask about this in the past, but have only seen fake tests go through, I've never seen a malicious script make it through - whether someone has tried is unknown, but that's across hundreds of accounts.

[SilvyaT]

hi, those rules seesm to be blocked

[Jnix284]

@SilvyaT as I mentioned, you can't add rules to existing fields. New custom fields would have to be created. Validation rules are new, so I'm not sure if that's why it is limited to new fields only.

[SilvyaT]

Happy new year

Thanks. Do you any plan when those will be rolled out for all the fields

we have a lot of forms and this would really help from security perspective