A critical vulnerability has been detected in PHPMailer. More than 9 million websites use PHPMailer. It is one of the most popular open source libraries.
Joomla and WordPress, to name a few of the CMSs, and millions of PHP sites use the PHPMailer library to send emails to users through a variety of methods, including sending via SMTP.
This is a critical flaw that can compromise every website that uses an email sending system.
Discovered by a security researcher
Discovered by Dawid Golunski, a Polish security researcher at Legal Hackers, the critical vulnerability (CVE-2016-10033 and CVE-2016-10045) allows hackers to remotely execute source code in the hosting environment and compromise the application.
“To exploit the vulnerability, an attacker could target common components such as contact / feedback forms, registration forms, password resets and others that send emails using a vulnerable version of the PHPMailer class,” Golunski wrote in the advisory published on December 26, 2016.
Golunski responsibly disclosed the vulnerability to the library’s developers, who fixed it in their new version, PHPMailer 5.2.18, before he released the information to the public. (Update of 12/29/2016 at 1:45 p.m.: a new fix is available: PHPMailer 5.2.20)
All versions of PHPMailer before the critical version 5.2.20 are affected, so web administrators and developers are strongly advised to update to the patched version.
We are one of the first French-language sites to disclose this information about the vulnerability following Golunski’s advisory, and millions of websites remain unpatched. The researcher has held back the technical details of the flaw to allow administrators to fix it. However, Golunski promised in his statement to release more technical details about the vulnerability in the coming days, including proof-of-concept exploit code and a video demonstration showing the attack in action. (Update of 12/28/2016: By the time we transcribed this article, the exploit had already been released and is already available!)
Bots will soon start scanning the web
As we write this article, we estimate that a large share of the sites using this library are still vulnerable, we estimate that 80% are still vulnerable, and bots will soon appear to scan the web looking for this flaw to exploit it.
We therefore strongly recommend that you patch your website’s PHPMailer library as quickly as possible to avoid mishaps. If you use a CMS, check for CMS updates every day and don’t hesitate to update your system to the latest versions.
Additional resources
- https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html
- https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10045-Vuln-Patch-Bypass.html
- https://github.com/PHPMailer/PHPMailer/blob/master/SECURITY.md
- https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities
- Joomla’s statement about this flaw: https://www.joomla.fr/actualites/joomla-org/item/1658-vulnerabilite-de-phpmailer-le-point-sur-la-situation
Don’t hesitate to contact us if you need help.
