Patchfirst
Patchfirst
CVE-2016-10033 KEVPublic exploit Critical · 9.8 EPSS 99.7%

PHPMailer Command Injection Vulnerability

PHP · PHPMailer

Summary

The PHPMailer library (vendor PHP) has a command injection flaw in the mailSend function of its isMail transport in versions before 5.2.18, where the Sender property is not properly neutralised before being passed to the mail command. An unauthenticated remote attacker who can supply a crafted Sender value containing a backslash-double-quote sequence can inject extra parameters into the mail command and execute arbitrary code, with no user interaction or special configuration required beyond the isMail transport being in use.

Official description · NVD

The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.

Breakdown
69.9 / 100
Exploited
Yes, in CISA KEV
Reports
0
Tactics
2/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

  1. How attackers get in

  2. What they do

First seen exploited 5 years after disclosure. Public exploit code (Exploit-DB) was available 5 days before disclosure.

  1. Public exploit codeExploit-DB5 days before
  2. Disclosedday 0
  3. First seen exploitedVulnCheck KEV evidence+5 yrs
  4. Added to CISA KEVEU database agrees+9 yrs

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

See the family tree

A fix was bypassed or incomplete once on the same day. The latest fix listed for phpmailer/phpmailer is 5.2.24.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

  1. This CVECVE-2016-10033PHPMailer Command Injection30 Dec 2016KEV
  2. incomplete fixHigh

    Why these are linked:

    • Stated in the CVE textNOTE: this vulnerability exists because of an incorrect fix for CVE-2016-10033.
    • Fixed one release later5.2.18 → 5.2.20 (phpmailer/phpmailer)
    • Similar weakness in the same product (machine-matched)same package + description similarity
    CVE-2016-10045The isMail transport in PHPMailer before 5.2.20 might allow…30 Dec 2016

Fixes in phpmailer/phpmailerPackagist package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 5.2.0CVE-2006-57346 Nov 2006
  2. 5.2.10CVE-2008-561917 Dec 2008
  3. 5.2.14CVE-2015-847616 Dec 2015
  4. 5.2.18CVE-2016-1003330 Dec 2016KEV
  5. 5.2.20CVE-2016-1004530 Dec 2016
  6. 5.2.22CVE-2017-522316 Jan 2017
  7. 5.2.24CVE-2017-1150320 Jul 2017Latest listed

techniques

2 , grouped by in kill-chain order 2

Initial AccessTA0001

Exploit Public-Facing Application T1190 Medium
MITRE CTID mapping of the KEV entry · how it is exploited

ExecutionTA0002

Unix Shell T1059.004 Medium
MITRE CTID mapping of the KEV entry · primary impact

Detection

0 rules for this CVE · 168 general rules for its techniques

Rules for this CVE

0 that reference CVE-2016-10033 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Exploit Public-Facing ApplicationT1190149 general rules
All 149 on SigmaHQ ↗
Unix ShellT1059.00419 general rules
All 19 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: phpmailer/phpmailer.

Packagistphpmailer/phpmailerGHSA-5f37-gxvh-23v6

Upgrade to 5.2.20 or later

Fixes this CVE and 2 other known vulnerabilities in this package (CVE-2008-5619, CVE-2016-10045).

Set the version to 5.2.20 or later in your composer.json.

First fixed in 5.2.18 for CVE-2016-10033.

Affected versions

If you runUpgrade to
5.0.0 up to 5.2.185.2.20first fix for this CVE: 5.2.18

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

22 links, grouped by NVD tag (21 duplicates merged)

Vendor Advisory 2

github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities

Patch 4

seclists.org/fulldisclosure/2016/Dec/78legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.htmlexploit-db.com/exploits/40968/exploit-db.com/exploits/40970/

US Government Resource 1

cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-10033

Third Party Advisory 15

packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.htmlpacketstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.htmlrapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injectionsecurityfocus.com/archive/1/539963/100/0/threadedsecurityfocus.com/bid/95108securitytracker.com/id/1037533developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.htmldrupal.org/psa-2016-004
Show 7 moreShow fewerexploit-db.com/exploits/40969/exploit-db.com/exploits/40974/exploit-db.com/exploits/40986/exploit-db.com/exploits/41962/exploit-db.com/exploits/41996/exploit-db.com/exploits/42024/exploit-db.com/exploits/42221/
↑ ↓ chooseEnter openEsc close