Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PHPMailer Exploit – Remote Code Execution

legalhackers.com

Post reply on HN
Print view View original

51–60 of 109 posts

Re: PHPMailer Exploit – Remote Code Execution

#51

Post by tyingq »

0x0 wrote: post #3

The advisory says exploitation is not limited to just systems running the original Sendmail MTA, but Postfix' "sendmail" wrapper apparently ignores the "-X" parameter... so how can a Postfix-based system be exploited?

I believe it's because the exploit isn't actually exploiting sendmail, it's expoiting /bin/sh sh -c .

Php's implementation of popen() doesn't invoke commands directly with stdlib's execl() or execle()...it calls stdlib's popen(), which passes it through /bin/sh -c .

That's assuming phpmailer doesn't treat a postfix sendmail wrapper differently than sendmail.

Edit: As far as I can tell, php doesn't allow any way to spawn a process without passing it to /bin/sh. That's odd, as other script languages like Perl and Python provide that. It avoids a whole class of exploits.

Edit2: It seems to be exploiting the "-f" option, not "-X". The postfix wrapper supports that.

Re: PHPMailer Exploit – Remote Code Execution

#52

Post by prab97 »

jexyru wrote: post #30

This discussion is broken by design. Using user input from contact form as "From" address for emails, sent from your site, is the mistake of your application - you should use something like "noreply@yoursite.com", why you put user email there? In addition - most probably such emails will not pass spam filters.

You would probably want to respond to the user, and it is possible only if they give you their email in the form. Although, this can be solved by treating the From field in the mail form as just a field of information and have that in the body of email. But that would make automated replies difficult.

Re: PHPMailer Exploit – Remote Code Execution

#54

Post by koheripbal »

dfc wrote: post #50
based2 wrote: post #44

https://www.reddit.com/r/netsec/comments/5kot1a/phpmailer_52...

I am curious why you linked to reddit? There is nothing in the discussion (4 comments) that is not in the linked advisory. Looking back through your comment history you seem to do this a lot, even linking to discussion pages on reddit with no comments whatsoever and the same link as found in the HN submission.

Looks like a bot to me. Literally only pastes links. I'd suspect that some of the websites it links to generate ad-rev, while the wikipedia and reddit links are there to obfuscate the purpose of the bot.

It's simple logic. If you notice, both the Reddit and HN source have the same source url.

Re: PHPMailer Exploit – Remote Code Execution

#55

Post by tyingq »

Sanddancer wrote: post #13

The root cause of this is that PHP's mail function is broken by design. Instead of parameterized values for everything, it passes the entirety of the "additional" options, which includes the from address, as one string for the shell to parse. If the flags were pulled out to individual options to be passed to the command instead, it wouldn't be possible to exploit things in the way it does. So, instead of: mail ( stri…

As far as I can tell, PHP doesn't have any way to spawn a subprocess without passing it to /bin/sh for evaluation.

PHPMailer (not core php) apparently either calls php's popen(), which passes to the shell...or calls php's mail(), which uses popen(). There are other options in php, like proc_open(), but they also call /bin/sh.

TLDR: There isn't any way in PHP to avoid "relying on the shell to separate options for you".

Re: PHPMailer Exploit – Remote Code Execution

#56

Post by diegoperini »

koheripbal wrote: post #48
rompic wrote: post #15

PHPMailer is also used by wordpress: https://www.wordfence.com/blog/2016/12/phpmailer-vulnerabili...

It's times like this I'm glad I have a country block setup through ipdeny. Reducing the likelihood of attack by two orders of magnitude is a big help until there's a patch.

No it is unfortunately not if there exists at least one company that provides a VPN service from your country. :)

Re: PHPMailer Exploit – Remote Code Execution

#57

Post by zxcvb »

wila wrote: post #53

Claiming it is a responsible disclosure, because of a post at a forum somewhere does not make it responsible. Edit: I should probably clarify that it is the 1 day timeline over Christmas that I think is irresponsible.

Not sure why you're getting downvoted because you are absolutely correct.

Re: PHPMailer Exploit – Remote Code Execution

#58

Post by jstewartmobile »

Per the writeup, it looks like they were already escaping their arguments, but they didn't know PHP's built-in mail() function was already doing that:

   PHPMailer 5.2.17 sanitizes the $Sender variable
   by applying escapeshellarg() escaping before the
   value is passed to mail() function.

   It does not however take into account the clashing
   of the escapeshellarg() function with internal
   escaping with escapeshellcmd() performed by mail()
   function on the 5th parameter.

   As a result it is possible to inject an extra quote
   that does not get properly escaped and break out of
   the escapeshellarg() protection applied by the patch
   in PHPMailer 5.2.17.
In most cases, people are using PHP as a server-side language under a web server. In those cases, it really isn't a good idea to send mail in-process anyway due to web-process and SMTP timeouts. Queueing messages with something like Gearman or some other job handler would be a more secure and performant approach.

Re: PHPMailer Exploit – Remote Code Execution

#59

Post by manquer »

prab97 wrote: post #52
jexyru wrote: post #30

This discussion is broken by design. Using user input from contact form as "From" address for emails, sent from your site, is the mistake of your application - you should use something like "noreply@yoursite.com", why you put user email there? In addition - most probably such emails will not pass spam filters.

You would probably want to respond to the user, and it is possible only if they give you their email in the form. Although, this can be solved by treating the From field in the mail form as just a field of information and have that in the body of email. But that would make automated replies difficult.

you could use reply-to header instead of from, being another additional header i guess it has the same problem.

Re: PHPMailer Exploit – Remote Code Execution

#60

Post by [deleted] »

jstewartmobile wrote: post #58

Per the writeup, it looks like they were already escaping their arguments, but they didn't know PHP's built-in mail() function was already doing that: PHPMailer 5.2.17 sanitizes the $Sender variable by applying escapeshellarg() escaping before the value is passed to mail() function. It does not however take into account the clashing of the escapeshellarg() function with internal escaping with escapeshellcmd() perform…

[deleted]
Post reply on HN