PT-2021-12009 · Phpmailer · Phpmailer

Published 2021-04-28 · Updated 2024-03-06 · CVE-2020-36326

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: PHPMailer versions 6.1.8 through 6.4.0

Description: The issue allows object injection through Phar Deserialization via the addAttachment method with a UNC pathname. This is a reintroduction of an earlier problem due to an unrelated bug fix in PHPMailer 6.1.8. An external file may be unexpectedly executable if it is used as a path to an attachment file via PHP's support for .phar files. Exploitation requires that an attacker is able to provide an unfiltered path to a file to attach, or to trick calling code into generating one.

Recommendations: For PHPMailer versions 6.1.8 through 6.4.0, update to PHPMailer 6.4.1 to resolve the issue. As a temporary workaround, validate paths to loaded files using the same pattern as used in isPermittedPath() before using them in any PHP file function, such as file exists. This should be applied to all user-supplied paths passed into such functions.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

CWE-641

Related Identifiers

BIT-PHPMAILER-2020-36326

BIT-WORDPRESS-2020-36326

BIT-WORDPRESS-MULTISITE-2020-36326

CVE-2020-36326

DLA-2731-1

GHSA-M298-FH5C-JC66

Affected Products

Phpmailer

References · 23

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/phpmailer/phpmailer/CVE-2020-36326.yaml · Exploit
• https://github.com/PHPMailer/PHPMailer/commit/e2e07a355ee8ff36aba21d0242c5950c56e4c6f9 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-36326 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-36326 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36326 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KPU66INRFY5BQ3ESVPRUXJR4DXQAFJVT · Vendor Advisory
• https://osv.dev/vulnerability/BIT-wordpress-2020-36326 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/KPU66INRFY5BQ3ESVPRUXJR4DXQAFJVT · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/3B5WDPGUFNPG4NAZ6G4BZX43BKLAVA5B · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3B5WDPGUFNPG4NAZ6G4BZX43BKLAVA5B · Vendor Advisory
• https://osv.dev/vulnerability/BIT-wordpress-multisite-2020-36326 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-36326 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-36326 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2020-36326 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2731-1 · Vendor Advisory