CVE-2021-3603: Inclusion of Functionality from Untrusted Control Sphere in PHPMailer/PHPMailer
First published: Wed Jun 16 2021(Updated: )
If a function is defined that has the same name as the default built-in email address validation scheme (`php`), it will be called in default configuration as when no validation scheme is provided, the default scheme's callable `php` was being called. If an attacker is able to inject such a function into the application (a much bigger issue), it will be called whenever an email address is validated, such as when calling `validateAddress()`. ### Impact Low impact – exploitation requires that an attacker can already inject code into an application, but it provides a trigger pathway. ### Patches This is patched in PHPMailer 6.5.0 by denying the use of simple strings as validator function names, which is a very minor BC break. ### Workarounds Inject your own email validator function. ### References Reported by [Vikrant Singh Chauhan](mailto:vi@hackberry.xyz) via [huntr.dev](https://www.huntr.dev/). [CVE-2021-3603](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3603) ### For more information If you have any questions or comments about this advisory: * Open an issue in [the PHPMailer project](https://github.com/PHPMailer/PHPMailer) * [Email us](mailto:phpmailer@synchromedia.co.uk).
Credit: security@huntr.dev security@huntr.dev
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/phpmailer/phpmailer | <6.5.0 | 6.5.0 |
| Phpmailer Project Phpmailer | <=6.4.1 | |
| Fedoraproject Fedora | =33 | |
| Fedoraproject Fedora | =34 | |
| composer/phpmailer/phpmailer | <6.5.0 | 6.5.0 |
| debian/libphp-phpmailer | <=6.2.0-2 | 6.6.3-1 6.9.1-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/PHPMailer/PHPMailer/releases/tag/v6.5.0
- https://github.com/PHPMailer/PHPMailer/commit/45f3c18dc6a2de1cb1bf49b9b249a9ee36a5f7f3
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YRMWGA4VTMXFB22KICMB7YMFZNFV3EJ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FJYSOFCUBS67J3TKR74SD3C454N7VTYM/
- https://www.huntr.dev/bounties/1-PHPMailer/PHPMailer/
- https://launchpad.net/bugs/cve/CVE-2021-3603
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YRMWGA4VTMXFB22KICMB7YMFZNFV3EJ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FJYSOFCUBS67J3TKR74SD3C454N7VTYM/
- https://github.com/PHPMailer/PHPMailer/security/advisories/GHSA-77mr-wc79-m8j3
- https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3603
- https://nvd.nist.gov/vuln/detail/CVE-2021-3603
- https://github.com/FriendsOfPHP/security-advisories/blob/master/phpmailer/phpmailer/CVE-2021-3603.yaml
- https://github.com/advisories/GHSA-77mr-wc79-m8j3 (Advisory)
- https://security-tracker.debian.org/tracker/CVE-2021-3603
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3603
- https://ubuntu.com/security/CVE-2021-3603
Frequently Asked Questions
What is CVE-2021-3603?
CVE-2021-3603 is a vulnerability that allows untrusted code to be run from an overridden address validator.
What software is affected by CVE-2021-3603?
The software affected by CVE-2021-3603 is phpmailer version up to and excluding 6.5.0.
How do I fix CVE-2021-3603?
To fix CVE-2021-3603, update phpmailer to version 6.5.0 or higher.
Where can I find more information about CVE-2021-3603?
More information about CVE-2021-3603 can be found at the following link: https://github.com/PHPMailer/PHPMailer/releases/tag/v6.5.0
- collector/friends-of-php
- collector/nvd-index
- agent/type
- collector/launchpad-cve
- source/Launchpad
- agent/author
- agent/first-publish-date
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup
- agent/remedy
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-77mr-wc79-m8j3
- alias/CVE-2021-3603
- agent/weakness
- agent/severity
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/title
- collector/security-tracker-debian
- source/Debian
- collector/usn-cve
- source/Ubuntu
- agent/references
- agent/softwarecombine
- agent/tags
- agent/description
- agent/event
- agent/trending
- package-manager/composer
- vendor/phpmailer project
- canonical/phpmailer project phpmailer
- version/phpmailer project phpmailer/6.4.1
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/33
- version/fedoraproject fedora/34
- package-manager/debian