CVE-2020-36326

CRITICAL9.8EPSS 0.30%

Object injection in PHPMailer/PHPMailer

發布日:2021/5/4修改日:2024/2/17
也稱為:GHSA-m298-fh5c-jc66BIT-phpmailer-2020-36326BIT-wordpress-2020-36326BIT-wordpress-multisite-2020-36326

描述

### Impact This is a reintroduction of an earlier issue (CVE-2018-19296) by an unrelated bug fix in PHPMailer 6.1.8. An external file may be unexpectedly executable if it is used as a path to an attachment file via PHP's support for `.phar` files`. Exploitation requires that an attacker is able to provide an unfiltered path to a file to attach, or to trick calling code into generating one. See [this article](https://knasmueller.net/5-answers-about-php-phar-exploitation) for more info. ### Patches This issue was patched in the PHPMailer 6.4.1 release. This release also implements stricter filtering for attachment paths; paths that look like *any* kind of URL are rejected. ### Workarounds Validate paths to loaded files using the same pattern as used in [`isPermittedPath()`](https://github.com/PHPMailer/PHPMailer/blob/master/src/PHPMailer.php#L1815) before using them in *any* PHP file function, such as `file_exists`. This method can't be used directly because it is protected, but you can implement the same thing in calling code. Note that this should be applied to *all* user-supplied paths passed into such functions; it's not a problem specific to PHPMailer. ### Credit This issue was found by Fariskhi Vidyan, reported and managed via Tidelift.

受影響套件(5)

  • Bitnami/phpmailer>= 6.1.8, < 6.4.1
  • Bitnami/wordpress>= 3.7.0, < 3.7.36, >= 3.8.0, < 3.8.36, >= 3.9.0, < 3.9.34, >= 4.0.0, < 4.0.33, >= 4.1.0, < 4.1.33, >= 4.2.0, < 4.2.30, >= 4.3.0, < 4.3.26, >= 4.4.0, < 4.4.25, >= 4.5.0, < 4.5.24, >= 4.6.0, < 4.6.21, >= 4.7.0, < 4.7.21, >= 4.8.0, < 4.8.17, >= 4.9.0, < 4.9.18, >= 5.0.0, < 5.0.13, >= 5.1.0, < 5.1.10, >= 5.2.0, < 5.2.11, >= 5.3.0, < 5.3.8, >= 5.4.0, < 5.4.6, >= 5.5.0, < 5.5.5, >= 5.6.0, < 5.6.4, >= 5.7.0, < 5.7.2
  • Bitnami/wordpress-multisite>= 3.7.0, < 3.7.36, >= 3.8.0, < 3.8.36, >= 3.9.0, < 3.9.34, >= 4.0.0, < 4.0.33, >= 4.1.0, < 4.1.33, >= 4.2.0, < 4.2.30, >= 4.3.0, < 4.3.26, >= 4.4.0, < 4.4.25, >= 4.5.0, < 4.5.24, >= 4.6.0, < 4.6.21, >= 4.7.0, < 4.7.21, >= 4.8.0, < 4.8.17, >= 4.9.0, < 4.9.18, >= 5.0.0, < 5.0.13, >= 5.1.0, < 5.1.10, >= 5.2.0, < 5.2.11, >= 5.3.0, < 5.3.8, >= 5.4.0, < 5.4.6, >= 5.5.0, < 5.5.5, >= 5.6.0, < 5.6.4, >= 5.7.0, < 5.7.2
  • Debian/libphp-phpmailerfrom 0, < 6.2.0-2
  • Packagist/phpmailer/phpmailer>= 6.1.8, < 6.4.1

CVSS 分數

來源版本嚴重程度向量
osvCVSS 3.1CRITICAL9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

參考連結(10)