PHPMailer Multiple RCE and Object Injection Vulnerabilities Analysis (CVE-2021-3603/34551)

### Critical Vulnerability Information #### 1. CVE-2021-3603 - **Affected Versions**: PHPMailer 6.4.1 and earlier - **Vulnerability Description**: When the `$patternselect` parameter is set to `'php'` and the global namespace contains a function named `php`, it may lead to execution of untrusted code. - **Fix**: Version 6.5.0 mitigated this vulnerability by refusing to use simple strings as validator function names. #### 2. CVE-2021-34551 - **Affected Versions**: PHPMailer 6.4.1 and earlier - **Vulnerability Description**: Passing unfiltered user input via the `$lang_path` parameter could lead to remote code execution, provided the server can load files from UNC paths and the attacker can control script files under that path. - **Fix**: Version 6.5.0 resolved this by no longer treating translation files as PHP code, instead parsing their text content to avoid executing unknown code. #### 3. CVE-2020-36326 - **Affected Versions**: PHPMailer 6.1.8 to 6.4.0 - **Vulnerability Description**: A regression of an object injection vulnerability introduced while fixing the Windows UNC path issue. - **Fix**: Version 6.4.1 fixed this issue and implemented stricter checks on URL schemes. #### 4. CVE-2020-13625 - **Affected Versions**: PHPMailer 6.1.5 and earlier - **Vulnerability Description**: An output escaping flaw when attachment filenames contain double quote characters, potentially allowing bypass of attachment filters based on filename extensions. - **Fix**: No specific vulnerability was found, but the issue was patched as a precaution. #### 5. CVE-2018-19296 - **Affected Versions**: PHPMailer versions prior to 6.0.6 and 5.2.27 - **Vulnerability Description**: Passing `phar://` paths via `addAttachment` and other functions that accept unfiltered local paths could lead to remote code execution. - **Fix**: Blocked the use of paths containing URL protocol-style prefixes. #### Others - **XSS Vulnerability**: Versions prior to 5.2.24 contained an XSS vulnerability in code examples (CVE-2017-11503). - **Local File Disclosure**: Versions prior to 5.2.22 had a local file disclosure vulnerability (CVE-2017-5223). - **Remote Code Execution**: Multiple versions were affected by various remote code execution vulnerabilities, such as CVE-2016-10045, CVE-2016-10033, CVE-2015-8476, etc.

Goal Reached Thanks to every supporter — we hit 100%!

PHPMailer Multiple RCE and Object Injection Vulnerabilities Analysis (CVE-2021-3603/34551)

More from this source