CVE-2020-13625: Phpmailer/phpmailer Insufficient Output Escaping Of Attachment Vulnerability

Q: What is CVE-2020-13625?

CVE-2020-13625 is a security vulnerability in Phpmailer/phpmailer involving Insufficient output escaping of attachment names in PHPMailer under CWE-116: Improper Encoding or Escaping of Output.

Q: Which Phpmailer/phpmailer versions are affected?

Affected versions include releases prior to 6.1.6 across affected packages: phpmailer/phpmailer.

Q: What version fixes CVE-2020-13625?

Upgrading to 6.1.6 (or the latest patched release for your respective branch) resolves the vulnerability.

Q: Is phpmailer/phpmailer affected?

Yes, phpmailer/phpmailer is affected in releases prior to 6.1.6. Upgrade your dependency to 6.1.6 or later.

Q: What is the CVSS score of CVE-2020-13625?

CVE-2020-13625 has a CVSS v3.1 base score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.

Q: What CWE is associated with CVE-2020-13625?

CVE-2020-13625 is classified under CWE-116: Improper Encoding or Escaping of Output (The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.).

Q: How can I check Packagist dependencies for CVE-2020-13625?

Run the dependency tree command: 'inspect dependencies for phpmailer/phpmailer'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

HIGH

Advisory Identifier: GHSA-f7hx-fqxw-rvvj

CVSS 7.5

CWE-116

Published 2020-05-27

Advisory Summary

CVE-2020-13625 is a HIGH (CVSS 7.5) insufficient output escaping of attachment vulnerability (CWE-116: Improper Encoding or Escaping of Output) affecting Phpmailer/phpmailer libraries in the Packagist ecosystem. The issue involves insufficient output escaping of attachment names in phpmailer. Remediation is available by upgrading affected packages to version 6.1.6.

CVE-2020-13625 at a Glance

CVE Identifier CVE-2020-13625

GHSA Identifier GHSA-f7hx-fqxw-rvvj

Severity HIGH

CVSS v3.1 Base Score 7.5

CWE Classification CWE-116: Improper Encoding or Escaping of Output

Affected Product Phpmailer/phpmailer

Package Ecosystem Packagist

Published Date 2020-05-27

Last Updated 2023-01-20

Security Impact

CVSS: 7.5

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).

Attack Vector Network (AV:N)

Attack Complexity Low (AC:L)

Privileges Required None (PR:N)

User Interaction None (UI:N)

Scope Unchanged (S:U)

Confidentiality None (C:N)

Integrity High (I:H)

Availability None (A:N)

How to Fix CVE-2020-13625

To remediate this vulnerability, upgrade all affected Phpmailer/phpmailer dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

phpmailer/phpmailer fixed: 6.1.6

Upgrade phpmailer/phpmailer to 6.1.6

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release:

inspect dependencies for phpmailer/phpmailer

How to Check if You Are Affected

To determine whether your application is affected by CVE-2020-13625, inspect your project dependencies for Phpmailer/phpmailer:

inspect dependencies for phpmailer/phpmailer

Analyze the terminal output to locate any version of Phpmailer/phpmailer in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 6.1.6), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & RFC 5280 Specification

Under RFC 5280 specifications for X.509 certificates, the Name Constraints extension defines a namespace within which all subsequent subject names in a certification path must be located. Constraints apply to various name forms including directory names, IP addresses, rfc822Name (email addresses), and uniformResourceIdentifier (URI) entries. Specifically, during certificate path validation, affected versions of Phpmailer/phpmailer failed to properly normalize or enforce boundary checks when domain names contained trailing dot (.) characters. Because domain names with a trailing dot signify fully qualified domain names (FQDNs), this omission allowed non-conforming certificates to be improperly validated as compliant with the defined name constraints.

Source Advisory Statement

### Impact CWE-116: Incorrect output escaping. An attachment added like this (note the double quote within the attachment name, which is entirely valid): $mail->addAttachment('/tmp/attachment.tmp', 'filename.html";.jpg'); Will result in a message containing these headers: Content-Type: application/octet-stream; name="filename.html";.jpg" Content-Disposition: attachment; filename="filename.html";.jpg" The attachment will be named `filename.html`, and the trailing `";.jpg"` will be ignored. Mail filters that reject `.html` attachments but permit `.jpg` attachments may be fooled by this. Note that the MIME type itself is obtained automatically from the *source filename* (in this case `attachment.tmp`, which maps to a generic `application/octet-stream` type), and not the *name* given to the attachment (though these are the same if a separate name is not provided), though it can be set explicitly in other parameters to attachment methods. ### Patches Patched in PHPMailer 6.1.6 by escaping double quotes within the name using a backslash, as per RFC822 section 3.4.1, resulting in correctly escaped headers like this: Content-Type: application/octet-stream; name="filename.html\";.jpg" Content-Disposition: attachment; filename="filename.html\";.jpg" ### Workarounds Reject or filter names and filenames containing double quote (`"`) characters before passing them to attachment functions such as `addAttachment()`. ### References [CVE-2020-13625](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-13625). [PHPMailer 6.1.6 release](https://github.com/PHPMailer/PHPMailer/releases/tag/v6.1.6) ### For more information If you have any questions or comments about this advisory: * Open an issue in [the PHPMailer repo](https://github.com/PHPMailer/PHPMailer/issues)

CVE-2020-13625 Affected Phpmailer/phpmailer Versions

1 component(s)

Fixed Versions:

6.1.6

Product / Package	Ecosystem	Affected Versions	Fixed Version
phpmailer/phpmailer	Packagist	< 6.1.6	6.1.6

References

GitHub Advisory / Wiki ADVISORY

https://github.com/PHPMailer/PHPMailer/security/advisories/GHSA-f7hx-fqxw-rvvj

NVD — CVE-2020-13625 NVD

https://nvd.nist.gov/vuln/detail/CVE-2020-13625

Security Fix Commit FIX COMMIT

https://github.com/PHPMailer/PHPMailer/commit/c2796cb1cb99d7717290b48c4e6f32cb6c60b7b3

Phpmailer/phpmailer Source Repository REPOSITORY

https://github.com/PHPMailer/PHPMailer

Phpmailer/phpmailer Release RELEASE

https://github.com/PHPMailer/PHPMailer/releases/tag/v6.1.6

lists.debian.org/debian-lts-announce... WEB

https://lists.debian.org/debian-lts-announce/2020/06/msg00014.html

lists.debian.org/debian-lts-announce... WEB

https://lists.debian.org/debian-lts-announce/2020/08/msg00004.html

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EFM3BZABL6RUHTVMXSC7OFMP4CKWMRPJ

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SMH4TC5XTS3KZVGMSKEPPBZ2XTZCKKCX

usn.ubuntu.com/4505-1 WEB

https://usn.ubuntu.com/4505-1

Phpmailer/phpmailer Security Information SECURITY

http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html

Phpmailer/phpmailer Security Information SECURITY

http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html

Frequently Asked Questions

What is CVE-2020-13625?

CVE-2020-13625 is a security vulnerability in Phpmailer/phpmailer involving Insufficient output escaping of attachment names in PHPMailer under CWE-116: Improper Encoding or Escaping of Output.

Which Phpmailer/phpmailer versions are affected?

Affected versions include releases prior to 6.1.6 across affected packages: phpmailer/phpmailer.

What version fixes CVE-2020-13625?

Upgrading to 6.1.6 (or the latest patched release for your respective branch) resolves the vulnerability.

Is phpmailer/phpmailer affected?

Yes, phpmailer/phpmailer is affected in releases prior to 6.1.6. Upgrade your dependency to 6.1.6 or later.

What is the CVSS score of CVE-2020-13625?

CVE-2020-13625 has a CVSS v3.1 base score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.

What CWE is associated with CVE-2020-13625?

CVE-2020-13625 is classified under CWE-116: Improper Encoding or Escaping of Output (The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.).

How can I check Packagist dependencies for CVE-2020-13625?

Run the dependency tree command: 'inspect dependencies for phpmailer/phpmailer'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

Machine-readable OSV JSON OSV v1.5 Schema

Normalized schema output

View Raw JSON

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-f7hx-fqxw-rvvj",
  "modified" : "2023-01-20T22:02:41Z",
  "published" : "2020-05-27T16:37:02Z",
  "aliases" : [ "CVE-2020-13625" ],
  "summary" : "Insufficient output escaping of attachment names in PHPMailer",
  "details" : "### Impact\nCWE-116: Incorrect output escaping.\n\nAn attachment added like this (note the double quote within the attachment name, which is entirely valid):\n\n    $mail->addAttachment('/tmp/attachment.tmp', 'filename.html\";.jpg');\n\nWill result in a message containing these headers:\n\n    Content-Type: application/octet-stream; name=\"filename.html\";.jpg\"\n    Content-Disposition: attachment; filename=\"filename.html\";.jpg\"\n\nThe attachment will be named `filename.html`, and the trailing `\";.jpg\"` will be ignored. Mail filters that reject `.html` attachments but permit `.jpg` attachments may be fooled by this.\n\nNote that the MIME type itself is obtained automatically from the *source filename* (in this case `attachment.tmp`, which maps to a generic `application/octet-stream` type), and not the *name* given to the attachment (though these are the same if a separate name is not provided), though it can be set explicitly in other parameters to attachment methods.\n\n### Patches\nPatched in PHPMailer 6.1.6 by escaping double quotes within the name using a backslash, as per RFC822 section 3.4.1, resulting in correctly escaped headers like this:\n\n    Content-Type: application/octet-stream; name=\"filename.html\\\";.jpg\"\n    Content-Disposition: attachment; filename=\"filename.html\\\";.jpg\"\n\n### Workarounds\nReject or filter names and filenames containing double quote (`\"`) characters before passing them to attachment functions such as `addAttachment()`.\n\n### References\n[CVE-2020-13625](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-13625).\n[PHPMailer 6.1.6 release](https://github.com/PHPMailer/PHPMailer/releases/tag/v6.1.6)\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [the PHPMailer repo](https://github.com/PHPMailer/PHPMailer/issues)",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "phpmailer/phpmailer"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "6.1.6"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/PHPMailer/PHPMailer/security/advisories/GHSA-f7hx-fqxw-rvvj"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2020-13625"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/PHPMailer/PHPMailer/commit/c2796cb1cb99d7717290b48c4e6f32cb6c60b7b3"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/PHPMailer/PHPMailer"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/PHPMailer/PHPMailer/releases/tag/v6.1.6"
  }, {
    "type" : "WEB",
    "url" : "https://lists.debian.org/debian-lts-announce/2020/06/msg00014.html"
  }, {
    "type" : "WEB",
    "url" : "https://lists.debian.org/debian-lts-announce/2020/08/msg00004.html"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EFM3BZABL6RUHTVMXSC7OFMP4CKWMRPJ"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SMH4TC5XTS3KZVGMSKEPPBZ2XTZCKKCX"
  }, {
    "type" : "WEB",
    "url" : "https://usn.ubuntu.com/4505-1"
  }, {
    "type" : "WEB",
    "url" : "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html"
  }, {
    "type" : "WEB",
    "url" : "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-116" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2020-05-27T16:34:44Z",
    "nvd_published_at" : "2020-06-08T17:15:00Z"
  }
}

CVSS V3

7.5 HIGH