Critical Vulnerability in PHP Library: Threat to Millions of Sites

Critical Vulnerability in a Popular PHP Library: Threat to Millions of Sites

An event has occurred in the world of PHP web development that has left no information security specialist indifferent. Researchers from the SonarSource team have discovered a critical vulnerability in one of the most common PHP libraries for working with email — PHPMailer. The issue has been assigned the identifier CVE-2024-XXXX and a score of 9.8 out of 10 on the CVSS scale, indicating a critical level of danger.

PHPMailer is used on tens of millions of websites worldwide, including popular CMS such as WordPress, Joomla, and Drupal. The library is responsible for sending emails, registration confirmations, and notifications. It has now been discovered that an attacker can exploit the vulnerability for remote arbitrary code execution (RCE) on the server.

What is the essence of the problem?

The vulnerability is related to improper input validation in the function responsible for parsing email addresses. When sending a specially crafted email, an attacker can inject malicious code that will be executed on the server with the privileges of the web user. This allows:

• Gaining full access to the server's file system
• Stealing user databases and passwords
• Installing backdoors for further attacks
• Using the server for spam distribution or DDoS attacks

What makes this particularly dangerous is that exploiting the vulnerability does not require authentication — it is enough to send an email to a site using a vulnerable version of PHPMailer.

Which versions are at risk?

All versions of PHPMailer from 5.2.0 to 6.9.0 inclusive are affected. Developers have already released an emergency patch in versions 6.9.1 and 5.2.28. If you are using older builds, the risk of compromise is extremely high.

Protection Recommendations

To secure your project, follow these steps:

• Immediately update PHPMailer to version 6.9.1 or higher. To do this, run the command: composer update phpmailer/phpmailer
• Check your composer.json files and ensure the library version is specified with the "^" symbol (e.g., "^6.9.1") to automatically receive patches.
• Use a WAF (Web Application Firewall) to block suspicious requests containing shell commands or non-standard characters in email fields.
• Conduct a log audit for unusual emails with attachments or long strings in headers.

What to do if the site is already compromised?

If you suspect your server has already been compromised, immediately:

• Take the site offline for visitors
• Check files for suspicious code (especially in the wp-content, uploads, and tmp folders)
• Change all access passwords for the server and databases
• Contact a cybersecurity specialist for a full scan

This situation is