Critical Vulnerability in libphp-phpmailer: Untrusted Code Execution Risk
Summary
DEBIAN-CVE-2021-3603: PHPMailer 6.4.1 and earlier contain a vulnerability that can result in untrusted code being called (if such code is injected into the host project's scope by other means). Affects libphp-phpmailer versions < 6.6.3-1. Fixed in 6.6.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libphp-phpmailer is a widely used PHP library that facilitates the sending of emails through PHP applications. It provides a robust set of features for email validation, attachment handling, and SMTP support. However, versions 6.4.1 and earlier are susceptible to a vulnerability that allows untrusted code execution if certain conditions are met, posing a significant security risk to applications relying on this library.
Vulnerability Detail
The vulnerability arises from the way the validateAddress() function handles the $patternselect parameter. When set to 'php' (the default), and if the global namespace contains a function named 'php', this function will be executed instead of the intended built-in validator. This can lead to arbitrary code execution if an attacker manages to inject malicious code into the host project's scope. The issue was mitigated in version 6.5.0, which disallows simple strings as validator function names, thus preventing this exploit.
How To Fix
Minimum fixed version
6.6.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libphp-phpmailerTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can manually set the $patternselect parameter to a different value that does not invoke the global 'php' function. For example, you can use a custom validator function that does not conflict with existing global functions.
Conclusion
The vulnerability in libphp-phpmailer poses a serious risk due to the potential for untrusted code execution. It is crucial for users of this library to update to the patched version 6.6.3-1 or later to ensure their applications remain secure. Additionally, utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in real-time.
See every vulnerability recorded for libphp-phpmailer →
FAQ
The main risk is the potential for untrusted code execution, which can lead to unauthorized access, data breaches, or complete system compromise.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Versions 6.4.1 and earlier of libphp-phpmailer are vulnerable to this issue.
Yes, the vulnerability has been patched in version 6.6.3-1 and later of libphp-phpmailer.
If you cannot update the package immediately, consider implementing the suggested workaround to mitigate the risk until you can apply the update.
References
Related vulnerabilities
Recent vulnerabilities recorded for libphp-phpmailer.
