CVE-2017-15806: Zeta Components Mail Arbitrary code execution via a crafted email address
Summary
CVE-2017-15806: Zeta Components Mail Arbitrary code execution via a crafted email address. Affects zetacomponents/mail versions < 1.8.2. Fixed in 1.8.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Zeta Components Mail is a package available on Packagist that provides functionality for sending and receiving emails. It is widely used in various PHP applications. The package includes the ezcMailMtaTransport class, which is responsible for sending emails. However, prior to version 1.8.2, there was a vulnerability in the send function of this class that allowed remote attackers to execute arbitrary code via a crafted email address.
Vulnerability Detail
The vulnerability in Zeta Components Mail arises from the improper restriction of characters used in the ezcMail returnPath property. This allows an attacker to inject arbitrary code into the email address, leading to potential code execution when the email is processed. An attacker could exploit this vulnerability by crafting an email address containing malicious code, such as "-X/path/to/wwwroot/file.php." When the email is processed, the malicious code would be executed, potentially leading to unauthorized access or other malicious activities.
How To Fix
Minimum fixed version
1.8.2
This is the first release that contains the fix.
composer require zetacomponents/mail:1.8.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to update the package to the latest version.
Conclusion
The vulnerability in Zeta Components Mail allows remote attackers to execute arbitrary code by injecting it into a crafted email address. To mitigate this vulnerability, it is crucial to update the package to version 1.8.2 or later. This will ensure that the necessary restrictions are in place to prevent code injection. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for zetacomponents/mail →
FAQ
Zeta Components Mail is a package available on Packagist that provides functionality for sending and receiving emails in PHP applications.
This vulnerability allows remote attackers to execute arbitrary code by injecting it into a crafted email address. This could lead to unauthorized access, data breaches, or other malicious activities.
To fix this vulnerability, update Zeta Components Mail to version 1.8.2 or later.
There is no specific workaround mentioned for this vulnerability. Updating the package to the latest version is the recommended approach.
For more information about this vulnerability, you can refer to the CVE-2017-15806 advisory or the GitHub advisory database.
