Arbitrary Shell Command Execution in PHPMailer
Summary
CVE-2007-3215: PHPMailer 1.7, when configured to use sendmail, allows remote attackers to execute arbitrary shell commands via shell metacharacters in the SendmailSend function in class.phpmailer.php. Affects libphp-phpmailer versions < 1.73-4. Fixed in 1.73-4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHPMailer is a popular open-source library used for sending emails in PHP applications. It provides a convenient and feature-rich interface for composing and sending emails. However, a vulnerability exists in PHPMailer versions 1.7 and earlier when configured to use sendmail as the mail transfer agent. This vulnerability allows remote attackers to execute arbitrary shell commands by exploiting shell metacharacters in the SendmailSend function in class.phpmailer.php.
Vulnerability Detail
The vulnerability (CVE-2007-3215) in PHPMailer arises due to insufficient input validation in the SendmailSend function. When an attacker crafts a malicious email and sends it through PHPMailer, they can include shell metacharacters in certain fields, such as the 'From' or 'Subject' headers. These metacharacters are not properly sanitized, allowing the attacker to inject arbitrary shell commands. When the email is processed and sent using the sendmail command, the injected commands are executed with the privileges of the web server user, potentially leading to unauthorized access, data leakage, or further compromise of the system.
How To Fix
Minimum fixed version
1.73-4
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libphp-phpmailerTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading PHPMailer is not immediately feasible, a temporary workaround is to switch to a different mail transfer agent that is not affected by this vulnerability. For example, you can configure PHPMailer to use SMTP instead of sendmail. By using SMTP, the vulnerability can be mitigated as long as the SMTP server does not pass user-controlled data to a shell command.
Conclusion
The vulnerability in PHPMailer versions 1.7 and earlier can allow remote attackers to execute arbitrary shell commands on the server. To mitigate this risk, it is crucial to upgrade to PHPMailer version 1.73-4 or later. Alternatively, you can switch to a different mail transfer agent, such as SMTP, until the upgrade is performed. For further support and assistance in vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for libphp-phpmailer →
FAQ
PHPMailer is an open-source library that provides a convenient way to send emails from PHP applications. It offers various features such as support for multiple email protocols, attachments, HTML content, and more.
If your application uses PHPMailer with sendmail as the mail transfer agent, and it processes user-controlled data without proper input validation, an attacker can exploit this vulnerability to execute arbitrary shell commands on the server. This can lead to unauthorized access, data leakage, or further compromise of the system.
No, only PHPMailer versions 1.7 and earlier are affected by this vulnerability. It is recommended to upgrade to version 1.73-4 or later to mitigate the risk.
Yes, if upgrading PHPMailer is not immediately feasible, you can switch to a different mail transfer agent that is not affected by this vulnerability. Configuring PHPMailer to use SMTP instead of sendmail can help mitigate the risk.
You can find more information about this vulnerability, including technical details and the patch, in the official CVE-2007-3215 advisory.
Related vulnerabilities
Recent vulnerabilities recorded for libphp-phpmailer.
