Add SMTP Server Integration for Email-Based Security Labs

[preetkaran20]

We need to integrate a local SMTP server into VulnerableApp to support email-related vulnerability labs (e.g., password reset, email injection, verification flows) without relying on external email providers.

This will enable safe, offline, and cost-free teaching of email security concepts.

🚀 Goals
Enable VulnerableApp to send emails via a local SMTP server
Capture and display emails in a UI for students
Support multiple security labs (reset password, verification, notifications)
Ensure zero dependency on external email providers
This is only available for Modern UI via VulnerableApp-Facade
Look at VulnerableApp docker-compose.yaml

🧱 Proposed Solution

1. SMTP Server (Local Dev Setup)

Use one of the following:
Mailpit (recommended)
MailHog (alternative)
or others, you are free to choose the best one.

Run via Docker compose, facade UI:
UI Dashboard: http://localhost:8025

2. Backend Configuration
   Add configurable SMTP settings in application.properties

3. Email Service Layer
   Introduce a reusable email service:
   sendEmail(to, subject, body)
   sendHtmlEmail(to, subject, htmlBody)
   sendResetEmail(user, token)
   sendVerificationEmail(user, token)

🧪 Testing Requirements
Emails should appear in Mailpit UI
No external network dependency
Able to simulate:
reset password emails
verification emails
crafted payload injection cases

🔐 Security Lab Enablement (Future Use)

This integration will support:
Email header injection labs
Token leakage scenarios
Weak reset mechanisms
Enumeration via email responses

📦 Acceptance Criteria
SMTP server runs locally via Docker
App successfully sends emails to Mailpit/MailHog
Emails visible in web UI dashboard
No dependency on external email providers
Configurable SMTP settings added
Email service abstraction implemented

🧭 Notes
This is a foundational change for upcoming email security vulnerability modules in VulnerableApp and should be designed to remain extensible for future attack scenarios. It will be only available in Modern UI as that is docker based design.

[preetkaran20]

Design Document: SMTP Server Integration for VulnerableApp

---

1. Overview

This document describes the concrete implementation plan for integrating a local SMTP server (Mailpit) into VulnerableApp. The integration is foundational infrastructure for future email-based security labs (password reset, email header injection, token leakage, enumeration).

The feature lives entirely within the Docker / Modern UI stack. It does not affect the legacy Spring Boot standalone mode.

---

2. Technology Choice: Mailpit

Mailpit is chosen over MailHog for the following reasons:

Criterion	Mailpit	MailHog
Maintenance	Actively maintained (2024)	Effectively abandoned
UI	Modern, responsive	Dated
Docker image size	~20 MB	~40 MB
API	REST + WebSocket	REST only
SMTP auth support	Yes	Limited
Search/filter in UI	Yes	No

Docker image: axllent/mailpit:latest

Please research more on this

3. Repository Changes

3.1 docker-compose.yml (VulnerableApp root)

Add the mailpit service and expose it to the shared app_net network. The SMTP port (1025) remains internal to the network — only the UI port (8025) needs to be externally accessible for students.

  mailpit:
    image: axllent/mailpit:latest
    container_name: mailpit
    restart: unless-stopped
    ports:
      - "8025:8025"      # Web UI — accessible at http://localhost:8025
    expose:
      - "1025"           # SMTP port — internal to app_net only
    environment:
      - MP_MAX_MESSAGES=500
      - MP_DATA_FILE=/data/mailpit.db
    volumes:
      - mailpit_data:/data
    networks:
      - app_net
 
volumes:
  mailpit_data:
  ollama_data:            # existing

Placement: Add the mailpit service block before VulnerableApp-facade. Add mailpit to the depends_on list of VulnerableApp-facade so it starts before the facade (though actual readiness is SMTP-level, not HTTP-level, so no healthcheck is strictly necessary at this stage).

  VulnerableApp-facade:
    depends_on:
      - VulnerableApp-base
      - VulnerableApp-jsp
      - VulnerableApp-php
      - llmforge
      - mailpit          # ← add this

Note: Do NOT expose port 1025 externally. The Spring Boot app reaches Mailpit via the internal Docker network (mailpit:1025). Students access captured emails only through the Mailpit web UI at port 8025.

NOTE: There are multiple docker-compose files, ensure adding to them in VulnerableApp as well as VulnerableApp-Facade and LLMForge

3.2 docker-compose.local.yml (for local development testing)

Mirror the same mailpit block so ./scripts/testWithModernUI.sh picks it up correctly during development builds.

---

3.3 Spring Boot — application.properties

VulnerableApp uses Spring Boot's JavaMailSender infrastructure. Add the following to src/main/resources/application.properties:

# ── SMTP / Email Configuration ──────────────────────────────────────
spring.mail.host=${SMTP_HOST:mailpit}
spring.mail.port=${SMTP_PORT:1025}
spring.mail.username=${SMTP_USERNAME:}
spring.mail.password=${SMTP_PASSWORD:}
spring.mail.properties.mail.smtp.auth=false
spring.mail.properties.mail.smtp.starttls.enable=false
 
vulnerableapp.email.from=${EMAIL_FROM:no-reply@vulnerableapp.local}
vulnerableapp.email.base-url=${APP_BASE_URL:http://localhost}

Using ${ENV_VAR:default} syntax lets the values be overridden via Docker environment variables without changing the file, which is consistent with how OLLAMA_MODEL and OLLAMA_URL are handled in the existing compose file.

---

3.4 Spring Boot — Gradle dependency (build.gradle)

Add the Spring Mail starter:

dependencies {
    // existing deps...
    implementation 'org.springframework.boot:spring-boot-starter-mail'
}

---

4. Java Email Service Layer

4.1 Package location

src/main/java/org/sasanlabs/service/email/
    EmailService.java           (interface)
    EmailServiceImpl.java       (implementation)
    EmailConfiguration.java     (Spring @ConfigurationProperties bean)

---

5. Facade / Nginx Configuration

The Mailpit web UI runs on port 8025 and is accessed directly by students at http://localhost:8025. No Nginx proxy rule is required for the MVP — the UI is already served on its own port.

If a future iteration wants to serve Mailpit under the facade at /mailpit, add this to templates/default.conf.template:

location /mailpit/ {
    proxy_pass http://mailpit:8025/;
    proxy_set_header Host $host;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";  # needed for WebSocket live updates
}

This is present in VulnerableApp-facade

[preetkaran20]

https://github.com/SasanLabs/VulnerableApp/wiki/Design-Document:-SMTP-Server-Integration-for-VulnerableApp Design doc