[Bimi] What are "CGI scripts in Indicator payload" ?

[Hanno Böck <[e-mail]>]

Hi,

The BIMI draft, to be found at
https://www.ietf.org/archive/id/draft-brand-indicators-for-message-identification-05.html
contains the following paragraph in its "Security Considerations":

"8.7. CGI scripts in Indicator payload

MTAs and MVAs should aggressively police Indicators to ensure they are
the Indicators they claim to be, are within appropriate size limits,
and pass other sanity checks. Additionally, MTAs might cache good
Indicators and serve them directly to their MUAs, which would in
practice bypass any malicious dynamic payload set to trigger against an
end user but not an MTA."

I wanted to ask if anyone familiar with the spec can explain this.
Particularly, I would like to understand what "CGI scripts in Indicator
payloads" even means.

I mean... I know what CGI scripts are. But I don't see how they are
related to anything that is written here, or how they are even related
at all to the BIMI spec.

"payload in indicator" sounds like whoever wrote this wanted to address
injection attacks via the indicators. As those are SVG files, a very
plausible and likely risk are XSS attacks. And yes, the spec very
likely should contain recommendations how to address them. (Point
4.2.2 also seems to contain some remarks addressing that, but again, it
also contains a reference to the mysterious "elsewhere", where it seems
all the important information about BIMI security can be found.)

However... that would have nothing to do with CGI scripts. So... Can
someone please explain to me what "CGI scripts in Indicator payload"
means, and what exact scenario this part of the spec is trying to
address?

-- 
Hanno Böck - Independent security researcher
https://itsec.hboeck.de/