Executive brief
PHPMailer, a widely used library for sending emails in PHP applications, contains a vulnerability that could allow an attacker to execute malicious code on a server. By providing a specially crafted file path for an email attachment, an attacker can trigger the execution of hidden code within that file. This could lead to a full system takeover, data theft, or disruption of services.
Technical details
PHPMailer versions 6.1.8 through 6.4.0 are vulnerable to PHP object injection due to improper validation of attachment file paths. The vulnerability is a reintroduction of CVE-2018-19296 and occurs when an attacker can provide an unfiltered path using the 'phar://' wrapper to a file function like 'file_exists'. When PHP's Phar wrapper processes a file, it automatically deserializes metadata, which can be leveraged for remote code execution if a suitable POP chain exists in the application. The issue was addressed in version 6.4.1 by implementing stricter filtering that rejects paths resembling URLs or stream wrappers.
Affected products
- PHPMailer PHPMailer >= 6.1.8, < 6.4.1
Timeline
- 2021-04-28: advisory: NVD published date
- 2021-04-29: patched: PHPMailer 6.4.1 released
- 2021-05-04: disclosed: GitHub Advisory published