{"action":"created","issue":{"url":"https://api.github.com/repos/swiftmailer/swiftmailer/issues/844","repository_url":"https://api.github.com/repos/swiftmailer/swiftmailer","labels_url":"https://api.github.com/repos/swiftmailer/swiftmailer/issues/844/labels{/name}","comments_url":"https://api.github.com/repos/swiftmailer/swiftmailer/issues/844/comments","events_url":"https://api.github.com/repos/swiftmailer/swiftmailer/issues/844/events","html_url":"https://github.com/swiftmailer/swiftmailer/issues/844","id":197601219,"number":844,"title":"Security Issue","user":{"login":"pizzeys","id":108548,"avatar_url":"https://avatars.githubusercontent.com/u/108548?v=3","gravatar_id":"","url":"https://api.github.com/users/pizzeys","html_url":"https://github.com/pizzeys","followers_url":"https://api.github.com/users/pizzeys/followers","following_url":"https://api.github.com/users/pizzeys/following{/other_user}","gists_url":"https://api.github.com/users/pizzeys/gists{/gist_id}","starred_url":"https://api.github.com/users/pizzeys/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pizzeys/subscriptions","organizations_url":"https://api.github.com/users/pizzeys/orgs","repos_url":"https://api.github.com/users/pizzeys/repos","events_url":"https://api.github.com/users/pizzeys/events{/privacy}","received_events_url":"https://api.github.com/users/pizzeys/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-12-26T16:09:37Z","updated_at":"2016-12-27T12:57:01Z","closed_at":null,"body":"There's a bit of noise going around at the moment regarding a vulnerability in PHPMailer where if an attacker can control the from address a script uses they can pass arbitrary arguments to the sendmail binary, which, if it's actually sendmail, results in being able to write to an arbitrary file (and so on most PHP setups, likely RCE) and if not at least allows to pass other parameters the developer perhaps didn't intend.\r\n\r\nSwiftmailer is actually vulnerable to the same bug, if using the Swift_MailTransport transport - for example, one can do:\r\n\r\nsetFrom(array('\"x@y.com\\\" -X/tmp/test\"@test.php' => 'John Doe'))\r\n\r\nIs this expected? It would be quite easy for a script to be using this in a dangerous way, so it should probably be made clear in the documentation that this parameter should be handled with kid gloves, if so."},"comment":{"url":"https://api.github.com/repos/swiftmailer/swiftmailer/issues/comments/269322604","html_url":"https://github.com/swiftmailer/swiftmailer/issues/844#issuecomment-269322604","issue_url":"https://api.github.com/repos/swiftmailer/swiftmailer/issues/844","id":269322604,"user":{"login":"joserprieto","id":1142233,"avatar_url":"https://avatars.githubusercontent.com/u/1142233?v=3","gravatar_id":"","url":"https://api.github.com/users/joserprieto","html_url":"https://github.com/joserprieto","followers_url":"https://api.github.com/users/joserprieto/followers","following_url":"https://api.github.com/users/joserprieto/following{/other_user}","gists_url":"https://api.github.com/users/joserprieto/gists{/gist_id}","starred_url":"https://api.github.com/users/joserprieto/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joserprieto/subscriptions","organizations_url":"https://api.github.com/users/joserprieto/orgs","repos_url":"https://api.github.com/users/joserprieto/repos","events_url":"https://api.github.com/users/joserprieto/events{/privacy}","received_events_url":"https://api.github.com/users/joserprieto/received_events","type":"User","site_admin":false},"created_at":"2016-12-27T12:57:01Z","updated_at":"2016-12-27T12:57:01Z","body":"The complete vulnerability is described here:\r\n\r\nhttp://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html\r\n\r\nAnd the key concept is:\r\n\r\n> Further research however shown that the validation is done using the RFC 3696 specification.\r\n> \r\n> The RFC allows emails to contain spaces when quoted with \". \r\n> According to the spec, the following email address is valid:\r\n> \r\n> \" some test email address with spaces\"@weird-email.com\r\n> \r\n\r\nI can't test this right now, but, if you can send an email like this:\r\n\r\n```\r\n$email_from = '\"attacker\\\" -oQ/tmp/ -X/var/www/cache/phpcode.php  some\"@email.com';\r\n$msg_body  = \"<?php phpinfo(); ?>\";\r\n```\r\n\r\nYou can test the vulnerability.\r\n\r\nRegards.\r\n"}}
{"actor":{"display_login":"joserprieto"}}