Executive brief
CodeIgniter is a popular software framework used by developers to build websites. A security flaw in its email-sending component allows attackers to remotely run unauthorized commands on the server. This could lead to a complete takeover of the website, theft of customer data, or a total service outage.
Technical details
A remote code execution vulnerability exists in the Email library of CodeIgniter versions prior to 3.1.3. The root cause is improper neutralization of input in the 'from' field (CWE-74), which allows an attacker to inject additional command-line arguments into the sendmail binary. By manipulating these arguments, a remote, unauthenticated attacker can execute arbitrary shell commands on the host system. This vulnerability is reachable over the network without user interaction. Users should upgrade to CodeIgniter 3.1.3 or later to resolve this issue.
Affected products
- bcit-ci CodeIgniter < 3.1.3
Timeline
- 2017-01-12: disclosed: NVD publication date
- 2017-01-12: patched: Version 3.1.3 released with fix
- 2022-05-17: advisory: GitHub Advisory published