Arbitrary Argument Injection Affecting php72-soap package, versions <0:7.2.13-1.7.amzn1


Severity

Recommended
medium

Based on Amazon Linux security rating

    Threat Intelligence

    Exploit Maturity
    Mature
    EPSS
    96.87% (100th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-AMZN201803-PHP72SOAP-1717652
  • published 27 Sep 2021
  • disclosed 25 Nov 2018

How to fix?

Upgrade Amazon-Linux:2018.03 php72-soap to version 0:7.2.13-1.7.amzn1 or higher.
This issue was patched in ALAS-2019-1147.

NVD Description

Note: Versions mentioned in the description apply only to the upstream php72-soap package and not the php72-soap package as distributed by Amazon-Linux. See How to fix? for Amazon-Linux:2018.03 relevant fixed versions and status.

University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh command (by means of the imap_rimap function in c-client/imap4r1.c and the tcp_aopen function in osdep/unix/tcp_unix.c) without preventing argument injection, which might allow remote attackers to execute arbitrary OS commands if the IMAP server name is untrusted input (e.g., entered by a user of a web application) and if rsh has been replaced by a program with different argument semantics. For example, if rsh is a link to ssh (as seen on Debian and Ubuntu systems), then the attack can use an IMAP server name containing a "-oProxyCommand" argument.

CVSS Scores

version 3.1
Expand this section

NVD

7.5 high
  • Attack Vector (AV)
    Network
  • Attack Complexity (AC)
    High
  • Privileges Required (PR)
    Low
  • User Interaction (UI)
    None
  • Scope (S)
    Unchanged
  • Confidentiality (C)
    High
  • Integrity (I)
    High
  • Availability (A)
    High