A critical stored HTML Injection vulnerability existed in DoorDash's email system for five years, allowing any free account to send phishing emails from the trusted no-reply@doordash.com domain. This flaw enabled attackers to bypass typical email security barriers by leveraging a legitimate sender address, significantly increasing the likelihood of successful phishing attacks. The vulnerability was misclassified in DoorDash's HackerOne Vulnerability Disclosure Program (VDP) for 15 months, delaying remediation. Although no known exploits are currently in the wild, the potential for abuse is high due to the trusted nature of the sender domain and the zero-barrier exploitation method. This issue highlights risks in vendor vulnerability management and the importance of accurate triage. European organizations using DoorDash services or receiving emails from this domain could be targeted for phishing campaigns exploiting this flaw. Immediate mitigation involves enhanced email filtering, user awareness, and verification of email authenticity. Countries with high DoorDash usage and significant e-commerce sectors, such as the UK, Germany, and France, are most likely to be affected. The severity is assessed as critical given the impact on confidentiality, integrity, and the ease of exploitation without authentication or user interaction requirements.
