Critical Object Injection Vulnerability in libphp-phpmailer: CVE-2020-36326
Summary
UBUNTU-CVE-2020-36326: PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname. Affects libphp-phpmailer versions < 6.2.0-2. Fixed in 6.2.0-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libphp-phpmailer is a widely used PHP library that facilitates the sending of emails from web applications. It provides a robust set of features for email composition, including support for attachments, HTML content, and SMTP authentication. However, versions 6.1.8 through 6.4.0 of this library are vulnerable to a critical object injection flaw that can be exploited through improper handling of UNC pathnames in attachments.
Vulnerability Detail
The vulnerability, identified as CVE-2020-36326, arises from a flaw in the handling of Phar Deserialization in PHPMailer versions 6.1.8 to 6.4.0. Specifically, the issue allows for object injection via the addAttachment method when a UNC pathname is used. This vulnerability can lead to remote code execution, data leakage, or other malicious activities, as it bypasses security checks that were previously in place. The flaw was introduced when a fix for a different issue inadvertently removed critical code that blocked exploitation through addAttachment.
How To Fix
Minimum fixed version
6.2.0-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libphp-phpmailerTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using UNC pathnames in the addAttachment method until the package is updated. Ensure that all file paths used in attachments are local and do not reference network shares.
Conclusion
CVE-2020-36326 represents a significant security risk for applications using vulnerable versions of libphp-phpmailer. It is crucial for developers and system administrators to update to the patched version to mitigate potential threats. Additionally, utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in real-time.
See every vulnerability recorded for libphp-phpmailer →
FAQ
CVE-2020-36326 is a critical vulnerability in the libphp-phpmailer package that allows for object injection through improper handling of UNC pathnames in attachments.
Exploitation of this vulnerability can lead to remote code execution, data leakage, and unauthorized access to sensitive information.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If an immediate update is not possible, avoid using UNC pathnames in the addAttachment method as a temporary workaround.
The CVSS score for CVE-2020-36326 is 9.8, indicating a critical level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for libphp-phpmailer.
