CVE-2017-15806
published 2017-11-15CVE-2017-15806: The send function in the ezcMailMtaTransport class in Zeta Components Mail before 1.8.2 does not properly restrict the set of characters used in the ezcMail…
PriorityP263high8.1CVSS 3.0
AVNACHPRNUINSUCHIHAH
EXPLOIT
EPSS
10.65%
95.2th percentile
The send function in the ezcMailMtaTransport class in Zeta Components Mail before 1.8.2 does not properly restrict the set of characters used in the ezcMail returnPath property, which might allow remote attackers to execute arbitrary code via a crafted email address, as demonstrated by one containing "-X/path/to/wwwroot/file.php."
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| zetacomponents | < 1.8.2 | 1.8.2 | |
| zetacomponents | >= 0 < 1.8.2 | 1.8.2 |
Detection & IOCsextracted from sources · hover to see the quote
- →Look for sendmail invocations containing the -X flag followed by a web-accessible path, which indicates abuse of the sendmail log-to-file feature via the returnPath property. ↗
- →Monitor the ezcMailMtaTransport send() call for returnPath/ezcMailAddress values containing shell metacharacters or flag-like substrings (e.g. -X, -O, -C) appended after a valid email address. ↗
- →Alert on new PHP files created in web-writable cache or public directories by the webserver process user, as the exploit drops a PHP shell via sendmail's -X logging flag. ↗
- ·Exploitation is only possible when the ezcMailMtaTransport class is used (not other transport classes in Zeta Components Mail). ↗
- ·The web root directory must be writable by the user the web server runs as for the dropped file to be created. ↗
CVSS provenance
nvdv3.08.1HIGHCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Zeta Components Mail Arbitrary code execution via a crafted email address
osv·2022-05-17
CVE-2017-15806 [HIGH] Zeta Components Mail Arbitrary code execution via a crafted email address
Zeta Components Mail Arbitrary code execution via a crafted email address
The send function in the ezcMailMtaTransport class in Zeta Components Mail before 1.8.2 does not properly restrict the set of characters used in the ezcMail returnPath property, which might allow remote attackers to execute arbitrary code via a crafted email address, as demonstrated by one containing "-X/path/to/wwwroot/file.php."
GHSA
Zeta Components Mail Arbitrary code execution via a crafted email address
ghsa·2022-05-17
CVE-2017-15806 [HIGH] CWE-94 Zeta Components Mail Arbitrary code execution via a crafted email address
Zeta Components Mail Arbitrary code execution via a crafted email address
The send function in the ezcMailMtaTransport class in Zeta Components Mail before 1.8.2 does not properly restrict the set of characters used in the ezcMail returnPath property, which might allow remote attackers to execute arbitrary code via a crafted email address, as demonstrated by one containing "-X/path/to/wwwroot/file.php."
No detection rules found.
No writeups or analysis indexed.
http://www.securityfocus.com/bid/101866https://github.com/zetacomponents/Mail/issues/58https://github.com/zetacomponents/Mail/releases/tag/1.8.2https://kay-malwarebenchmark.github.io/blog/cve-2017-15806-critical-rce-vulnerability/https://kay-malwarebenchmark.github.io/blog/cve-2017-15806-yuan-cheng-dai-ma-zhi-xing-lou-dong/https://www.exploit-db.com/exploits/43155/http://www.securityfocus.com/bid/101866https://github.com/zetacomponents/Mail/issues/58https://github.com/zetacomponents/Mail/releases/tag/1.8.2https://kay-malwarebenchmark.github.io/blog/cve-2017-15806-critical-rce-vulnerability/https://kay-malwarebenchmark.github.io/blog/cve-2017-15806-yuan-cheng-dai-ma-zhi-xing-lou-dong/https://www.exploit-db.com/exploits/43155/
2017-11-15
Published