PT-2021-3390 · Phpmailer+3 · Phpmailer+3

Vikrant Singh Chauhan · Published 2021-06-17 · Updated 2024-03-06 · CVE-2021-3603

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PHPMailer versions 6.4.1 and earlier

Description The issue is related to the validateAddress function in PHPMailer, which can lead to the execution of untrusted code if such code is injected into the host project's scope by other means. This occurs when the $patternselect parameter is set to 'php' (the default) and a function named php exists in the global namespace, causing it to be called instead of the built-in validator. The problem is associated with the inclusion of functions from an untrusted controlled area.

Recommendations For PHPMailer versions 6.4.1 and earlier, update to PHPMailer 6.5.0 to mitigate the issue, as it denies the use of simple strings as validator function names. As a temporary workaround, consider disabling the validateAddress() function until a patch is available. Restrict access to the global namespace to prevent the injection of malicious functions. Avoid using the php function name in the global namespace to minimize the risk of exploitation.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

CWE-829

Related Identifiers

BDU:2021-03241

BIT-PHPMAILER-2021-3603

CVE-2021-3603

GHSA-77MR-WC79-M8J3

MGASA-2021-0345

USN-5956-1

Affected Products

Debian

Linuxmint

Phpmailer

Ubuntu

References · 37

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/wp_phpmailer_host_header.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/phpmailer_arg_injection.rb · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/phpmailer/phpmailer/CVE-2021-3603.yaml · Exploit
• 🔥 https://github.com/opsxcq/exploit-CVE-2016-10033 · Exploit
• 🔥 https://github.com/GeneralTesler/CVE-2016-10033 · Exploit
• 🔥 https://github.com/chipironcin/CVE-2016-10033 · Exploit
• 🔥 https://github.com/0x00-0x00/CVE-2016-10033 · Exploit
• https://github.com/PHPMailer/PHPMailer/commit/45f3c18dc6a2de1cb1bf49b9b249a9ee36a5f7f3 · Patch
• https://ubuntu.com/security/CVE-2016-10033 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YRMWGA4VTMXFB22KICMB7YMFZNFV3EJ · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0345.html · Security Note
• https://ubuntu.com/security/CVE-2016-10045 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-3603 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-11503 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-03241 · Security Note