CVE-2018-19296: Object injection
Last updated 24 July 2024
Other sources
PHPMailer before 5.2.27 and 6.x before 6.0.6 is vulnerable to an object injection attack.
— Launchpad
PHPMailer versions prior to 6.0.6 and 5.2.27 are vulnerable to an object injection attack by passing phar:// paths into addAttachment() and other functions that may receive unfiltered local paths, possibly leading to RCE. See this article for more info on this type of vulnerability. Mitigated by blocking the use of paths containing URL-protocol style prefixes such as phar://. Reported by Sehun Oh of cyberone.kr.
Impact Object injection, possible remote code execution
Patches Fixed in 6.0.6 and 5.2.27
Workarounds Validate and sanitise user input before using.
References https://nvd.nist.gov/vuln/detail/CVE-2018-19296
For more information If you have any questions or comments about this advisory: Open a private issue in the PHPMailer project
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/phpmailer/phpmailerto a version that resolves this vulnerability.Fixed in 6.0.6 - Upgrade
Upgrade
composer/phpmailer/phpmailerto a version that resolves this vulnerability.Fixed in 5.2.27 - Upgrade
Upgrade
debian/libphp-phpmailerto a version that resolves this vulnerability.Fixed in 6.2.0-2Fixed in 6.6.3-1Fixed in 6.9.1-1 - Upgrade
Upgrade
PHPMailerto a version that resolves this vulnerability.Fixed in 6.0.6 - Upgrade
Upgrade
PHPMailerto a version that resolves this vulnerability.Fixed in 5.2.27 - Compensating control
Block the use of paths containing URL-protocol style prefixes such as phar://.
- Compensating control
Validate and sanitise user input before using it in PHPMailer functions that receive local paths.
Event History
Frequently Asked Questions
What is the vulnerability ID for the Object Injection vulnerability?
The vulnerability ID for the Object Injection vulnerability is CVE-2018-19296.
What is the severity of the Object Injection vulnerability?
The severity of the Object Injection vulnerability is high with a severity value of 8.8.
What is affected by the Object Injection vulnerability?
The Object Injection vulnerability affects PHPMailer before 5.2.27 and 6.x before 6.0.6, as well as other packages and systems listed in the vulnerability description.
How can I fix the Object Injection vulnerability?
To fix the Object Injection vulnerability, update PHPMailer to version 5.2.27 or 6.0.6 and follow any additional remediation steps mentioned in the relevant advisories.
Where can I find more information about the Object Injection vulnerability?
More information about the Object Injection vulnerability can be found on the official PHPMailer GitHub releases page, the Debian Security Tracker, and the MITRE CVE database.