CVE-2017-15806 Zeta Components Mail Arbitrary code execution via a crafted email address
Remote attackers can execute arbitrary code via crafted email addresses in the Zeta Components Mail library due to insufficient character restriction in the return path.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-15806?
CVE-2017-15806 is a high-severity code injection vulnerability in n/a, published on 15 Nov 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The send function in the ezcMailMtaTransport class in Zeta Components Mail before 1.8.2 does not properly restrict the set of characters used in the ezcMail returnPath property, which might allow remote attackers to execute arbitrary code via a crafted email address, as demonstrated by one containing "-X/path/to/wwwroot/file.php."
Weakness: CWE-94
Which versions are affected by CVE-2017-15806?
2 open source packages ship an affected version, including zetacomponents/mail. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
zetacomponents/mail Packagist | All versions | 1.8.2 |
zetacomponents/mail Packagist | All versions | 1.8.2 |
Products include Zetacomponents Mail.
How do I fix CVE-2017-15806?
Upgrade zetacomponents/mail to 1.8.2 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2017-15806 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2017-15806 exists.
Public exploit code: 1 Exploit-DB entry.
Sources
Also known as GHSA-hgr8-g756-vmg9.