ProofPoint Evasion
Date: 2019-09-09
Affected: ProofPoint Email Protection System
Attack vector: adversarial-input
Category: research
Severity: High
CVE: CVE-2019-20634
CVE-2021-45117
CVE-2021-45416
CVE-2022-35174
CVE-2023-24279
CVE-2023-30093
CVE-2023-30094
CWE: CWE-476
CWE-697
CWE-79
CVSS:  (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Proof Pudding (CVE-2019-20634) is a code repository that describes how ML researchers evaded ProofPoint's email protection system by first building a copy-cat email protection ML model, and using the insights to bypass the live system. More specifically, the insights allowed researchers to craft malicious emails that received preferable scores, going undetected by the system. Each word in an email is scored numerically based on multiple variables and if the overall score of the email is too low, ProofPoint will output an error, labeling it as SPAM.


Mitigations:

Architectural layers (MAESTRO):