PT-2017-16400 · Php+3 · Phpmailer+3

Yongxiang Li · Published 2017-01-10 · Updated 2023-03-15 · CVE-2017-5223

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions PHPMailer versions prior to 5.2.22

Description An issue in PHPMailer's msgHTML method allows it to apply transformations to an HTML document, making it usable as an email message body. One transformation converts relative image URLs into attachments using a script-provided base directory. If no base directory is provided, relative image URLs are treated as absolute local file paths and added as attachments. This can form a remote vulnerability if the msgHTML method is called with an unfiltered, user-supplied HTML document and no base directory is set. The impact of this issue is that arbitrary local files can be attached to email messages.

Recommendations For versions prior to 5.2.22, update to version 5.2.22 to resolve the issue. As a temporary workaround, consider validating input before using user-supplied file paths to minimize the risk of exploitation.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

ALT-PU-2017-1015

CVE-2017-5223

DLA-1591-1

DLA-817-1

GHSA-4X5H-CR29-FHP6

MGASA-2017-0022

USN-5956-1

Affected Products

Alt Linux

Linuxmint

Phpmailer

Ubuntu

References · 35

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/wp_phpmailer_host_header.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/phpmailer_arg_injection.rb · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/phpmailer/phpmailer/CVE-2017-5223.yaml · Exploit
• 🔥 https://github.com/opsxcq/exploit-CVE-2016-10033 · Exploit
• 🔥 https://github.com/GeneralTesler/CVE-2016-10033 · Exploit
• 🔥 https://github.com/chipironcin/CVE-2016-10033 · Exploit
• 🔥 https://github.com/0x00-0x00/CVE-2016-10033 · Exploit
• 🔥 http://kalilinux.co/2017/01/12/phpmailer-cve-2017-5223-local-information-disclosure-vulnerability-analysis · Exploit
• 🔥 https://exploit-db.com/exploits/43056 · Exploit
• https://github.com/PHPMailer/PHPMailer/blob/master/SECURITY.md · Patch
• https://ubuntu.com/security/CVE-2016-10033 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-5223 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/JTXZSKTKOWTVEXDS76R6GJGI3MLA2LL5 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-5223 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-5223 · Security Note