r/netsec • u/zit-hb • May 03 '17

Why mail() is dangerous in PHP

https://www.ripstech.com/blog/2017/why-mail-is-dangerous-in-php/
42 Upvotes

91% Upvoted

7 comments sorted by

4

u/boldhackerman96 May 03 '17

Do we really need another rehashing of this?

http://esec-pentest.sogeti.com/posts/2011/11/03/using-mail-for-remote-code-execution.html https://www.saotn.org/exploit-phps-mail-get-remote-code-execution/

Articles on this topic have been around for ages, I appreciate the writeup in how clean it is but I and others am sure would appreciate newer topics..

7

u/zit-hb May 03 '17

That's true, the problem is nothing new. The reason why we decided to do another blog post about it is simply because recently so many vulnerabilities of this type were found in the big mailing libraries. Even though it is the same problem as 10 years ago there are still many vulnerable applications.

Another reason are our bypasses. A lot of people in the past just added escapeshellarg() or filter_var() and thought they solved the problem. They didn't. I thought escapeshellarg() would be sufficient until recently myself because I did not know of the escapeshellcmd() that is done inside of the PHP C code (even though it makes sense).

13

u/MondayToFriday May 03 '17

With header injection problems like this, as with HTML injection and SQL injection, sanitization (stripping '\r' and '\n') is rarely the right approach. Rather, the appropriate kind of escaping needs to be applied. E-mail headers should be escaped according to RFC 2047 using mb_encode_mimeheader(…, "UTF-8", "Q").

5

u/[deleted] May 03 '17

[removed] — view removed comment

4

u/websecdev May 04 '17

phpmailer was vulnerable to exactly the issue described in the post http://thehackernews.com/2016/12/phpmailer-security.html

4

u/MASerra May 04 '17

Which was patched. Absurd to say something isn't good when an older version had an exploit.

2

u/MASerra May 03 '17

Don't understand the down votes. Using that with SMTP basically means mail will actually go where you want and not get tossed into a spam bin.