Information for Vuture Clients, Admin Users and Support or CSMs

Introduction

In Vuture’s ongoing efforts to keep our clients, and client data, secure, we constantly review and improve our security measures. A recent security review recommended that we add an additional layer of security to our create page by importing from a URL feature by only allowing content to be imported from a permitted list of URLs that are defined for each client. This is designed to reduce the chances of malicious content being imported from an external system.

The Solution

A new configuration setting has been created to store “allowed URLs” from where content may be imported to email pages and landing pages in Vuture. By default this config is blank so no content can be imported.

URLs that are added to the config must meet the following security requirements:

• The URL must begin with HTTPS: (i.e. it must be a secure connection)
• The URL cannot be an IP address and must be a public domain name
• The URL should not have any redirects as they will not be followed.

Any URL that has not been added to the config setting or does not meet the requirements above will not be usable when creating an email page or landing page through the import URL feature.

Set Up

Clients should create a list of URLs that may be used safely to import to an email from a URL and supply that list to Support or to their CSM.
The list is configured at Admin > System > Emails.
When the end user subsequently enters a URL on the 'Compose email' screen, Vuture will validate that the URL is one of the URLs listed in the above config and that it is an HTTPS: URL.
If the URL is a redirect it will not be followed so please enter the final destination URL when importing content.

1. Support or CSMs: Go to Admin > System > Emails
2. Enter a comma separated list of URLs in the 'Whitelisted URLs to import emails from' field
( https://www.bbc.co.uk,https://www.google.com,https://wikipedia.com is an example of the way the list could look but clients will have their own URLs). Remember, the URLs you enter must be HTTPS: and must have no redirect on them.
3. Click Save

 

Testing

Clients: To test for yourself that the list of approved URLs is working:
1. Go to the Emails module in the Vuture platform
2. Go to any email campaign
3. Click Compose Email
4. Enter the name of the email
5. Enter a URL that is one of the listed ones as configured in step 2 above.
6. Click 'Import email from URL'
7. Observe that the email is created successfully from the entered URL.
8. If you enter a URL that is not one of the listed ones, you will see an error message handling the security exception which will read 'https://www.XYZ.com/ is not one of the whitelisted URLs specified in Admin > System > Emails.'
9. URLs which are HTTP: not HTTPS: will also cause an error, as will URLs with a redirect on them.