CVE-2017-5223: Infoleak
An issue was discovered in PHPMailer before 5.2.22. PHPMailer's msgHTML method applies transformations to an HTML document to make it usable as an email message body. One of the transformations is to convert relative image URLs into attachments using a script-provided base directory. If no base directory is provided, it resolves to /, meaning that relative image URLs get treated as absolute local file paths and added as attachments. To form a remote vulnerability, the msgHTML method must be called, passed an unfiltered, user-supplied HTML document, and must not set a base directory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/phpmailer/phpmailerto a version that resolves this vulnerability.Fixed in 5.2.22 - Upgrade
Upgrade
debian/libphp-phpmailerto a version that resolves this vulnerability.Fixed in 6.2.0-2Fixed in 6.6.3-1Fixed in 6.9.1-1 - Upgrade
Upgrade
PHPMailerto a version that resolves this vulnerability.Fixed in 5.2.22 - Configuration
When using msgHTML, always provide a base directory so relative image URLs are not resolved to '/' and treated as absolute local file paths/attachments.
PHPMailer msgHTML base directory = set a base directory (do not leave it unset)
Event History
Frequently Asked Questions
What is the vulnerability ID of Local File Disclosure?
The vulnerability ID of Local File Disclosure is CVE-2017-5223.
What is the severity rating of CVE-2017-5223?
CVE-2017-5223 has a severity rating of 5.5 (medium).
What is the affected software for CVE-2017-5223?
The affected software for CVE-2017-5223 includes PHPMailer versions from 5.0.0 up to, but excluding, 5.2.22.
How can I fix the Local File Disclosure vulnerability?
To fix the Local File Disclosure vulnerability, update PHPMailer to version 5.2.22 or later.
Where can I find more information about CVE-2017-5223?
You can find more information about CVE-2017-5223 on the GitHub page for PHPMailer releases (https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.22) and the Kali Linux website (http://kalilinux.co/2017/01/12/phpmailer-cve-2017-5223-local-information-disclosure-vulnerability-analysis/).