CVE-2016-10034: zend-mail remote code execution via Sendmail adapter
Summary
CVE-2016-10034: zend-mail remote code execution via Sendmail adapter. Affects zendframework/zend-mail across 4 version ranges.
< 2.4.11
>= 2.5, <= 2.5.2
>= 2.6, <= 2.6.2
>= 2.7, < 2.7.2
Fixed in 2.4.11 or 2.7.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The zend-mail component is a part of the Zend Framework, which is a collection of professional PHP packages. It provides a simple and flexible API for sending emails using various adapters, including the Sendmail adapter. The Sendmail adapter allows sending emails using the local Sendmail command-line tool. This vulnerability affects versions before 2.4.11, 2.5.x, 2.6.x, and 2.7.x before 2.7.2 of the zend-mail component and Zend Framework.
Vulnerability Detail
The vulnerability, identified as CVE-2016-10034, exists in the setFrom function of the Sendmail adapter. It allows remote attackers to pass extra parameters to the mail command, potentially leading to the execution of arbitrary code. This can be achieved by including a backslash double quote (") in a crafted e-mail address. By exploiting this vulnerability, an attacker can execute arbitrary code on the target system, potentially gaining unauthorized access or causing further harm.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.4.112.4.11composer require zendframework/zend-mail:2.4.11 -
>= 2.7, < 2.7.22.7.2composer require zendframework/zend-mail:2.7.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can sanitize the input to the setFrom function and ensure that no backslash double quotes (") are present in the e-mail address. This can be done by implementing input validation and filtering mechanisms before passing the e-mail address to the setFrom function.
Conclusion
The zend-mail component and Zend Framework versions before 2.4.11, 2.5.x, 2.6.x, and 2.7.x before 2.7.2 are vulnerable to remote code execution via the Sendmail adapter. This vulnerability allows attackers to execute arbitrary code on the target system, potentially leading to unauthorized access or further compromise. It is crucial to update to the fixed versions or apply the recommended workarounds to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for zendframework/zend-mail →
FAQ
This vulnerability allows remote attackers to execute arbitrary code on the target system, potentially leading to unauthorized access or further compromise of the system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert analyzes your composer.lock file and provides real-time alerts for open-source vulnerabilities.
While specific exploits for this vulnerability may exist, they have not been disclosed publicly. However, it is crucial to patch the vulnerability as soon as possible to prevent potential exploitation.
At the moment, input validation and filtering are the recommended workarounds to mitigate the risk associated with this vulnerability. It is essential to update to the fixed versions as soon as possible.
The vulnerability was discovered by the GitHub Security Lab and reported to the Zend Framework security team.
Related vulnerabilities
Recent vulnerabilities recorded for zendframework/zend-mail.
