Critical Code Execution Vulnerability in Swift Mailer Package
Summary
CVE-2016-10074: The mail transport (aka Swift_Transport_MailTransport) in Swift Mailer before 5.4.5 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash do... Affects libphp-swiftmailer across 2 version ranges.
< 5.4.2-1.1
< 545ce9136690cea74f98f86fbb9c92dd9ab1a756
Fixed in 5.4.2-1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Swift Mailer is a popular open-source library used for sending emails from PHP applications. It provides a flexible and powerful API for composing and sending emails, supporting various transport methods. However, prior to version 5.4.5, Swift Mailer was vulnerable to a code execution flaw that could be exploited through specially crafted email headers.
Vulnerability Detail
The vulnerability, identified as CVE-2016-10074, arises from the mail transport mechanism in Swift Mailer, specifically the Swift_Transport_MailTransport class. Attackers can exploit this vulnerability by injecting a backslash double quote (") into crafted email addresses within the From, ReturnPath, or Sender headers. This can lead to the execution of arbitrary code on the server, posing a significant security risk. The CVSS score for this vulnerability is 9.8, indicating its critical nature and potential for severe impact.
How To Fix
Minimum fixed version
5.4.2-1.1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libphp-swiftmailerTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not possible, consider implementing input validation on email headers to sanitize user input and prevent the injection of malicious characters. This can be done by using PHP's filter_var function: filter_var($email, FILTER_SANITIZE_EMAIL).
Conclusion
The CVE-2016-10074 vulnerability in Swift Mailer poses a serious risk of arbitrary code execution through manipulated email headers. It is crucial for developers using this library to update to the latest version to safeguard their applications. Implementing input validation can serve as a temporary measure until the update is applied.
See every vulnerability recorded for libphp-swiftmailer →
FAQ
CVE-2016-10074 is a vulnerability in the Swift Mailer library that allows remote attackers to execute arbitrary code by injecting malicious characters into email headers.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized code execution on the server, potentially compromising the entire application and its data.
Yes, you can implement input validation to sanitize email headers and prevent the injection of malicious characters as a temporary workaround.
It is recommended to upgrade to Swift Mailer version 5.4.5 or later to fully mitigate the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for libphp-swiftmailer.
