Critical, CVSS 9.0PackagistPublished
php-imap vulnerable to RCE through a directory traversal vulnerability
CVE-2023-35169 · GHSA-47p7-xfcc-4pv9
- Affected
- Packagist webklex/laravel-imap < 5.3.0
- Fixed in
- 5.3.0· Vendor fix available
- Issue
- An unsanitized attachment filename allows any unauthenticated user to leverage a directory traversal vulnerability which results in a remote code execution vulnerability. Details An attacker can send an email with a malicious attachment to the inbox, which gets crawled with webklex/php-imap or webklex/laravel-imap. Prerequisite for the vulnerability is that the script stores the attachments without providing a $filename, or providing an unsanitized $filename, in src/Attachment::save(string $path, string $filename = null) (https://github.com/Webklex/php-imap/blob/5.2.0/src/Attachment.php#L251-L255). In this case, where no $filename gets passed into the Attachment::save() method, the package would use a series of unsanitized and insecure input values from the mail as fallback (https://github.com/Webklex/php-imap/blob/5.2.0/src/Attachment.php#L252). Even if a developer passes a $filename into the Attachment::save() method, e.g. by passing the name or filename of the mail…
Recommended action: Upgrade to 5.3.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.