Remote code execution in PHPMailer
### Impact The `isMail` transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the `mail` command and consequently execute arbitrary code by leveraging improper interaction between the `escapeshellarg` function and internal escaping performed in the mail function in PHP. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-10033. This issue really emphasises that it's worth avoiding the built-in PHP `mail()` function entirely. ### Patches Fixed in 5.2.20 ### Workarounds Send via SMTP to localhost instead of calling the `mail()` function. ### References https://nvd.nist.gov/vuln/detail/CVE-2016-10045 See also https://nvd.nist.gov/vuln/detail/CVE-2016-10033 ### For more information If you have any questions or comments about this advisory: * Open a private issue in [the PHPMailer project](https://github.com/PHPMailer/PHPMailer)
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2016-10045US | critical9.8 | Exploit | ||
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging impr… | ||||
references
External citations — patches, advisories, analysis.
- http://openwall.com/lists/oss-security/2016/12/28/1WEB
- http://packetstormsecurity.com/files/140286/PHPMailer-Remote-Code-Execution.htmlWEB
- http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.htmlWEB
- http://seclists.org/fulldisclosure/2016/Dec/81WEB
- http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injectionWEB
- https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.htmlWEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/phpmailer/phpmailer/CVE-2016-10045.yamlWEB
- https://github.com/PHPMailer/PHPMailerPACKAGE
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan