CVE-2016-10033: PHPMailer Command Injection Vulnerability
Impact The mailSend function in the default isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.
Patches Fixed in 5.2.18
Workarounds Filter and validate user input before passing it to internal functions.
References https://nvd.nist.gov/vuln/detail/CVE-2016-10033 Related to a follow-on issue in https://nvd.nist.gov/vuln/detail/CVE-2016-10045
For more information If you have any questions or comments about this advisory: Open a private issue in the PHPMailer project
Other sources
PHPMailer contains a command injection vulnerability because it fails to sanitize user-supplied input. Specifically, this issue affects the 'mail()' function of 'class.phpmailer.php' script. An attacker can exploit this issue to execute arbitrary code within the context of the application. Failed exploit attempts will result in a denial-of-service condition.
— CISA
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/phpmailer/phpmailerto a version that resolves this vulnerability.Fixed in 5.2.18 - Upgrade
Upgrade
debian/libphp-phpmailerto a version that resolves this vulnerability.Fixed in 6.2.0-2Fixed in 6.6.3-1Fixed in 6.9.1-1 - Upgrade
Upgrade
PHPMailerto a version that resolves this vulnerability.Fixed in 5.2.18 - Configuration
Ensure any user-controlled values assigned to the PHPMailer Sender property (used by class.phpmailer.php mailSend in the default isMail transport) are filtered and validated to prevent command injection (the advisory notes the vulnerability is due to PHPMailer failing to sanitize user-supplied input).
PHPMailer (class.phpmailer.php) Sender property input handling = Sanitize and validate user-supplied input before it is used by mailSend/isMail transport to call mail() - Compensating control
If you cannot apply the mitigation/fix, discontinue use of the product as the advisory instructs.
Event History
Frequently Asked Questions
What is the impact of CVE-2016-10033?
CVE-2016-10033 allows remote attackers to execute arbitrary code by passing extra parameters to the mail command via a crafted Sender property.
How can I fix CVE-2016-10033?
To fix CVE-2016-10033, update PHPMailer to version 5.2.18 or higher.
What is the severity level of CVE-2016-10033?
CVE-2016-10033 has a severity level of 9.8 (Critical).
Where can I find more information about CVE-2016-10033?
You can find more information about CVE-2016-10033 on the GitHub release page and the NVD website.
Which software is affected by CVE-2016-10033?
PHPMailer before version 5.2.18, libphp-phpmailer package, WordPress before version 4.7, and Joomla versions 1.5.0 to 3.6.5 are affected by CVE-2016-10033.