PT-2017-16400 · Php+3 · Phpmailer+3

Yongxiang Li · Publicado 2017-01-10 · Atualizado 2023-03-15 · CVE-2017-5223

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions PHPMailer versions prior to 5.2.22

Description An issue in PHPMailer's msgHTML method allows it to apply transformations to an HTML document, making it usable as an email message body. One transformation converts relative image URLs into attachments using a script-provided base directory. If no base directory is provided, relative image URLs are treated as absolute local file paths and added as attachments. This can form a remote vulnerability if the msgHTML method is called with an unfiltered, user-supplied HTML document and no base directory is set. The impact of this issue is that arbitrary local files can be attached to email messages.

Recommendations For versions prior to 5.2.22, update to version 5.2.22 to resolve the issue. As a temporary workaround, consider validating input before using user-supplied file paths to minimize the risk of exploitation.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

ALT-PU-2017-1015

CVE-2017-5223

DLA-1591-1

DLA-817-1

GHSA-4X5H-CR29-FHP6

MGASA-2017-0022

USN-5956-1

Produtos afetados

Alt Linux

Linuxmint

Phpmailer

Ubuntu

Referências · 35

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/wp_phpmailer_host_header.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/phpmailer_arg_injection.rb · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/phpmailer/phpmailer/CVE-2017-5223.yaml · Exploit
• 🔥 https://github.com/opsxcq/exploit-CVE-2016-10033 · Exploit
• 🔥 https://github.com/GeneralTesler/CVE-2016-10033 · Exploit
• 🔥 https://github.com/chipironcin/CVE-2016-10033 · Exploit
• 🔥 https://github.com/0x00-0x00/CVE-2016-10033 · Exploit
• 🔥 http://kalilinux.co/2017/01/12/phpmailer-cve-2017-5223-local-information-disclosure-vulnerability-analysis · Exploit
• 🔥 https://exploit-db.com/exploits/43056 · Exploit
• https://github.com/PHPMailer/PHPMailer/blob/master/SECURITY.md · Correção
• https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.22 · Nota
• https://github.com/PHPMailer/PHPMailer/security/advisories/GHSA-4x5h-cr29-fhp6 · Nota
• https://ubuntu.com/security/CVE-2016-10033 · Aviso do Fabricante
• http://securityfocus.com/bid/95328 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-5223 · Nota de Segurança