CVE-2017-15806

HIGH8.1EPSS 16.5%

Zeta Components Mail Arbitrary code execution via a crafted email address

Published: 5/17/2022Modified: 4/23/2024

Description

The send function in the ezcMailMtaTransport class in Zeta Components Mail before 1.8.2 does not properly restrict the set of characters used in the ezcMail returnPath property, which might allow remote attackers to execute arbitrary code via a crafted email address, as demonstrated by one containing "-X/path/to/wwwroot/file.php."

Affected packages (1)

Packagist/zetacomponents/mailfrom 0, < 1.8.2

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH8.1	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References (9)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2017-15806
PATCHhttps://github.com/zetacomponents/Mail
WEBhttps://github.com/FriendsOfPHP/security-advisories/blob/master/zetacomponents/mail/CVE-2017-15806.yaml
WEBhttps://github.com/zetacomponents/Mail/issues/58
WEBhttps://github.com/zetacomponents/Mail/releases/tag/1.8.2
WEBhttps://kay-malwarebenchmark.github.io/blog/cve-2017-15806-critical-rce-vulnerability
WEBhttps://kay-malwarebenchmark.github.io/blog/cve-2017-15806-yuan-cheng-dai-ma-zhi-xing-lou-dong
WEBhttps://www.exploit-db.com/exploits/43155
WEBhttp://www.securityfocus.com/bid/101866