GHSA-7w4p-72j7-v7c2

Dashboard / Vulnerabilities / GHSA-7w4p-72j7-v7c2

GHSA-7w4p-72j7-v7c2

Summary: Phar object injection in PHPMailer

Details: PHPMailer versions prior to 6.0.6 and 5.2.27 are vulnerable to an object injection attack by passing phar:// paths into `addAttachment()` and other functions that may receive unfiltered local paths, possibly leading to RCE. See [this article](https://knasmueller.net/5-answers-about-php-phar-exploitation) for more info on this type of vulnerability. Mitigated by blocking the use of paths containing URL-protocol style prefixes such as `phar://`. Reported by Sehun Oh of cyberone.kr. ### Impact Object injection, possible remote code execution ### Patches Fixed in 6.0.6 and 5.2.27 ### Workarounds Validate and sanitise user input before using. ### References https://nvd.nist.gov/vuln/detail/CVE-2018-19296 ### For more information If you have any questions or comments about this advisory: * Open a private issue in [the PHPMailer project](https://github.com/PHPMailer/PHPMailer)

References: https://github.com/PHPMailer/PHPMailer/security/advisories/GHSA-7w4p-72j7-v7c2, https://nvd.nist.gov/vuln/detail/CVE-2018-19296, https://github.com/FriendsOfPHP/security-advisories/blob/master/phpmailer/phpmailer/CVE-2018-19296.yaml, https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.27, https://github.com/PHPMailer/PHPMailer/releases/tag/v6.0.6, https://lists.debian.org/debian-lts-announce/2018/12/msg00020.html, https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3B5WDPGUFNPG4NAZ6G4BZX43BKLAVA5B, https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KPU66INRFY5BQ3ESVPRUXJR4DXQAFJVT, https://lists.fedoraproject.org/archives/list/[email protected]/message/3B5WDPGUFNPG4NAZ6G4BZX43BKLAVA5B, https://lists.fedoraproject.org/archives/list/[email protected]/message/KPU66INRFY5BQ3ESVPRUXJR4DXQAFJVT, https://www.debian.org/security/2018/dsa-4351