{"id":6274,"date":"2017-01-23T14:07:56","date_gmt":"2017-01-23T22:07:56","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2017\/01\/23\/news-125\/"},"modified":"2017-01-23T14:07:56","modified_gmt":"2017-01-23T22:07:56","slug":"news-125","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2017\/01\/23\/news-125\/","title":{"rendered":"SSD Advisory – ZendMail Remote Code Execution Vulnerability"},"content":{"rendered":"
\n

Vulnerability Summary<\/strong><\/p>\n

The following report describes a remote code execution vulnerability found in ZendMail. The vulnerability allows an attacker injecting additional parameters to the sendmail binary via the From<\/em> address.<\/p>\n

Credit<\/strong>
An independent security researcher Dawid Golunski (https:\/\/legalhackers.com\/<\/a>) has reported this vulnerability to Beyond Security\u2019s SecuriTeam Secure Disclosure program<\/p>\n

<\/span><\/p>\n

Vulnerability Details<\/strong><\/p>\n

“ZendMail provides generalized functionality to compose and send both text and MIME-compliant multipart email messages. Mail can be sent with ZendMail via the MailTransportSendmail, MailTransportSmtp or the MailTransportFile transport. Of course, you can also implement your own transport by implementing the MailTransportTransportInterface.”<\/p>\n

http:\/\/framework.zend.com\/manual\/current\/en\/modules\/zend.mail.introduction.html<\/em><\/a><\/p>\n

When using ZendMail class from ZendMail\/Zend framework to send emails with MailTransportSendmail transport, a malicious user might be able to inject arbitrary parameters to sendmail program due to insufficient address sanitization. If an attacker can control email headers , he could bypass sanitization by adding additional quote characters within a malicious email address. <\/p>\n

Prof of Concept<\/strong><\/p>\n<\/p>\n

\t\t<\/p>\n

\n
<\/span> \t\t\t<\/p>\n
<\/span><\/p>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n<\/div>\n<\/div>\n
<\/div>\n