CVE-2021-3603: Inclusion of Functionality from Untrusted Control Sphere in PHPMailer/PHPMailer
If a function is defined that has the same name as the default built-in email address validation scheme (php), it will be called in default configuration as when no validation scheme is provided, the default scheme's callable php was being called. If an attacker is able to inject such a function into the application (a much bigger issue), it will be called whenever an email address is validated, such as when calling validateAddress().
Impact Low impact – exploitation requires that an attacker can already inject code into an application, but it provides a trigger pathway.
Patches This is patched in PHPMailer 6.5.0 by denying the use of simple strings as validator function names, which is a very minor BC break.
Workarounds Inject your own email validator function.
References Reported by Vikrant Singh Chauhan via huntr.dev. CVE-2021-3603
For more information If you have any questions or comments about this advisory: Open an issue in the PHPMailer project Email us.
Other sources
PHPMailer 6.4.1 and earlier contain a vulnerability that can result in untrusted code being called (if such code is injected into the host project's scope by other means). If the $patternselect parameter to validateAddress() is set to 'php' (the default, defined by PHPMailer::$validator), and the global namespace contains a function called php, it will be called in preference to the built-in validator of the same name. Mitigated in PHPMailer 6.5.0 by denying the use of simple strings as validator function names.
— Launchpad
Untrusted code may be run from an overridden address validator
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/phpmailer/phpmailerto a version that resolves this vulnerability.Fixed in 6.5.0 - Upgrade
Upgrade
debian/libphp-phpmailerto a version that resolves this vulnerability.Fixed in 6.6.3-1Fixed in 6.9.1-1 - Upgrade
Upgrade
PHPMailer/PHPMailerto a version that resolves this vulnerability.Fixed in 6.5.0 - Configuration
Do not set PHPMailer::$validator / validateAddress() $patternselect to a simple string (e.g., 'php'); PHPMailer 6.5.0 mitigates by denying simple string validator function names.
PHPMailer validateAddress() $patternselect = 'php' denied as simple string validator function name
Event History
Frequently Asked Questions
What is CVE-2021-3603?
CVE-2021-3603 is a vulnerability that allows untrusted code to be run from an overridden address validator.
What software is affected by CVE-2021-3603?
The software affected by CVE-2021-3603 is phpmailer version up to and excluding 6.5.0.
How do I fix CVE-2021-3603?
To fix CVE-2021-3603, update phpmailer to version 6.5.0 or higher.
Where can I find more information about CVE-2021-3603?
More information about CVE-2021-3603 can be found at the following link: https://github.com/PHPMailer/PHPMailer/releases/tag/v6.5.0