PHPMailer Exploit – Remote Code Execution

Re:PHPMailer Exploit – Remote Code Execution by annnnd on Wednesday December 28, 2016 @05:45AM (#13269718)

Really? So you're saying this is a valid e-mail address?

    "\"Attacker\\' -Param2 -Param3\"@test.com"

Let's try it:

    <?php
      $sender = "\"Attacker\\' -Param2 -Param3\"@test.com";
      var_dump(filter_var($sender, FILTER_VALIDATE_EMAIL));
    // outputs:
    // bool(false)

[ Parent | on HN ]

Re:PHPMailer Exploit – Remote Code Execution by thaumaturgy on Wednesday December 28, 2016 @06:01AM (#13269777)

filter_var(...) explicitly does not strictly adhere to the RFCs.

And yes, that is, technically, a valid email address:

    "\"Attacker\\' -Param2 -Param3\"@test.com"

gets interpreted by the shell (or by PHP, or by whatever else is responsible for handling backslash-escaped entities in quoted strings) as

    "Attacker\' -Param2 -Param3"@test.com

and "Attacker\' -Param2 -Param3" is a valid local-part: https://tools.ietf.org/html/rfc5321#section-4.1.2

(Email addresses suck and this is not me saying that this is sane.)

[ Parent | on HN ]