The disclosed vulnerability is a critical stored HTML Injection flaw in DoorDash's email system that persisted for approximately five years. This vulnerability allowed any user with a free DoorDash account to inject malicious HTML content into emails sent from the official no-reply@doordash.com domain. Because these emails originated from a trusted and verified domain, attackers could craft phishing emails that bypassed many traditional email security controls such as spam filters and domain-based message authentication (e.g., DMARC, SPF). The flaw effectively enabled zero-barrier phishing campaigns, as no elevated privileges or complex exploitation steps were required. The vulnerability was reported but misclassified within DoorDash's HackerOne Vulnerability Disclosure Program for 15 months, delaying the patching process. Although there are no known active exploits in the wild, the potential impact is severe due to the trusted sender domain and the ability to deliver malicious payloads directly to recipients’ inboxes. This vulnerability underscores the risks of improper input validation and the critical need for rigorous triage and classification in vulnerability management programs. The lack of patch links suggests remediation may still be pending or undisclosed publicly. The issue was first publicly discussed on Reddit's NetSec community and is considered highly newsworthy due to its critical nature and the long duration it remained unaddressed.

For European organizations, this vulnerability poses a significant risk primarily through phishing attacks that could lead to credential theft, malware installation, or business email compromise. Since the phishing emails would appear to come from a legitimate and trusted DoorDash domain, users are more likely to trust and engage with malicious content, increasing the success rate of social engineering attacks. Organizations with employees who use DoorDash services or receive communications from DoorDash are at heightened risk. The potential compromise of user credentials or the delivery of malware could lead to data breaches, financial fraud, and disruption of business operations. Additionally, the reputational damage to DoorDash and its partners could indirectly affect European businesses relying on their services. The delayed remediation due to misclassification also highlights systemic risks in vulnerability management that could affect supply chain security. Overall, the impact extends beyond DoorDash customers to any entity targeted via phishing leveraging this vulnerability.

1. Implement advanced email filtering solutions that incorporate heuristic and behavioral analysis to detect phishing attempts, even from trusted domains. 2. Employ Domain-based Message Authentication, Reporting & Conformance (DMARC), SPF, and DKIM policies rigorously and monitor for anomalies in email sending patterns. 3. Educate employees and users about the risk of phishing emails, emphasizing caution even when emails appear from trusted sources. 4. Use email client protections such as disabling automatic HTML rendering or enabling safe reading modes to reduce the risk of malicious HTML execution. 5. Monitor and audit DoorDash-related email traffic for unusual patterns or unexpected content. 6. Engage with DoorDash to confirm remediation status and request transparency on patch deployment. 7. For organizations integrating DoorDash services, consider additional verification steps for communications and transactions initiated via email. 8. Review and improve internal vulnerability disclosure and triage processes to prevent misclassification and delays in remediation of critical vulnerabilities.