Attack vector
NETWORK Attack complexity
HIGH Privileges required
LOW Confidentiality impact
HIGH Integrity impact
HIGH Availability impact
HIGH Published: 2018-11-25
Updated: 2024-11-21
Summary
University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh command (by means of the imap_rimap function in c-client/imap4r1.c and the tcp_aopen function in osdep/unix/tcp_unix.c) without preventing argument injection, which might allow remote attackers to execute arbitrary OS commands if the IMAP server name is untrusted input (e.g., entered by a user of a web application) and if rsh has been replaced by a program with different argument semantics. For example, if rsh is a link to ssh (as seen on Debian and Ubuntu systems), then the attack can use an IMAP server name containing a "-oProxyCommand" argument.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Try All Common Application Switches and Options
An attacker attempts to invoke all common switches and options in the target application for the purpose of discovering weaknesses in the target. For example, in some applications, adding a --debug switch causes debugging information to be displayed, which can sometimes reveal sensitive processing or configuration information to an attacker. This attack differs from other forms of API abuse in that the attacker is blindly attempting to invoke options in the hope that one of them will work rather than specifically targeting a known option. Nonetheless, even if the attacker is familiar with the published options of a targeted application this attack method may still be fruitful as it might discover unpublicized functionality.
- Using Meta-characters in E-mail Headers to Inject Malicious Payloads
This type of attack involves an attacker leveraging meta-characters in email headers to inject improper behavior into email programs. Email software has become increasingly sophisticated and feature-rich. In addition, email applications are ubiquitous and connected directly to the Web making them ideal targets to launch and propagate attacks. As the user demand for new functionality in email applications grows, they become more like browsers with complex rendering and plug in routines. As more email functionality is included and abstracted from the user, this creates opportunities for attackers. Virtually all email applications do not list email header information by default, however the email header contains valuable attacker vectors for the attacker to exploit particularly if the behavior of the email client application is known. Meta-characters are hidden from the user, but can contain scripts, enumerations, probes, and other attacks against the user's system.
- HTTP Parameter Pollution (HPP)
An attacker overrides or adds HTTP GET/POST parameters by injecting query string delimiters. Via HPP it may be possible to override existing hardcoded HTTP parameters, modify the application behaviors, access and, potentially exploit, uncontrollable variables, and bypass input validation checkpoints and WAF rules.
- OS Command Injection
In this type of an attack, an adversary injects operating system commands into existing application functions. An application that uses untrusted input to build command strings is vulnerable. An adversary can leverage OS command injection in an application to elevate privileges, execute arbitrary commands and compromise the underlying operating system.
Exploit-Db
file | exploits/linux/remote/45914.rb |
id | EDB-ID:45914 |
last seen | 2018-11-30 |
modified | 2018-11-29 |
platform | linux |
port | |
published | 2018-11-29 |
reporter | Exploit-DB |
source | https://www.exploit-db.com/download/45914 |
title | PHP imap_open - Remote Code Execution (Metasploit) |
type | remote |
Metasploit
description | The imap_open function within php, if called without the /norsh flag, will attempt to preauthenticate an IMAP session. On Debian based systems, including Ubuntu, rsh is mapped to the ssh binary. Ssh's ProxyCommand option can be passed from imap_open to execute arbitrary commands. While many custom applications may use imap_open, this exploit works against the following applications: e107 v2, prestashop, SuiteCRM, as well as Custom, which simply prints the exploit strings for use. Prestashop exploitation requires the admin URI, and administrator credentials. suiteCRM/e107 require administrator credentials. Fixed in php 5.6.39. |
id | MSF:EXPLOIT/LINUX/HTTP/PHP_IMAP_OPEN_RCE |
last seen | 2020-06-12 |
modified | 2019-01-19 |
published | 2018-11-19 |
references | |
reporter | Rapid7 |
source | https://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/linux/http/php_imap_open_rce.rb |
title | php imap_open Remote Code Execution |
Nessus
NASL family | SuSE Local Security Checks |
NASL id | SUSE_SU-2018-3986-1.NASL |
description | This update for php53 fixes the following issues : Security issue fixed : CVE-2018-19518: Fixed imap_open script injection flaw (bsc#1117107). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. |
last seen | 2020-06-01 |
modified | 2020-06-02 |
plugin id | 119455 |
published | 2018-12-06 |
reporter | This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. |
source | https://www.tenable.com/plugins/nessus/119455 |
title | SUSE SLES11 Security Update : Recommended update for php53 (SUSE-SU-2018:3986-1) |
NASL family | Debian Local Security Checks |
NASL id | DEBIAN_DSA-4353.NASL |
description | Multiple security issues were found in PHP, a widely-used open source general purpose scripting language: The EXIF module was susceptible to denial of service/information disclosure when parsing malformed images, the Apache module allowed cross-site-scripting via the body of a |
last seen | 2020-04-30 |
modified | 2018-12-11 |
plugin id | 119561 |
published | 2018-12-11 |
reporter | This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof. |
source | https://www.tenable.com/plugins/nessus/119561 |
title | Debian DSA-4353-1 : php7.0 - security update |
NASL family | Debian Local Security Checks |
NASL id | DEBIAN_DLA-1700.NASL |
description | A vulnerability was discovered in uw-imap, the University of Washington IMAP Toolkit, that might allow remote attackers to execute arbitrary OS commands if the IMAP server name is untrusted input (e.g., entered by a user of a web application) and if rsh has been replaced by a program with different argument semantics. This update disables access to IMAP mailboxes through running imapd over rsh, and therefore ssh for users of the client application. Code which uses the library can still enable it with tcp_parameters() after making sure that the IMAP server name is sanitized. For Debian 8 |
last seen | 2020-06-01 |
modified | 2020-06-02 |
plugin id | 122548 |
published | 2019-03-04 |
reporter | This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof. |
source | https://www.tenable.com/plugins/nessus/122548 |
title | Debian DLA-1700-1 : uw-imap security update |
NASL family | CGI abuses |
NASL id | PHP_5_6_39.NASL |
description | According to its banner, the version of PHP running on the remote web server is 5.6.x prior to 5.6.39. It is, therefore, affected by multiple vulnerabilities: - An arbitrary command injection vulnerability exists in the imap_open function due to improper filters for mailbox names prior to passing them to rsh or ssh commands. An authenticated, remote attacker can exploit this by sending a specially crafted IMAP server name to cause the execution of arbitrary commands on the target system. (CVE-2018-19518) - A denial of service (DoS) vulnerability exists in ext/imap/php_imap.c. An unauthenticated, remote attacker can exploit this issue, via an empty string in the message argument to the imap_mail function, to cause the application to stop responding. (CVE-2018-19935) - A heap buffer over-read exists in the phar_parse_pharfile function. An unauthenticated, remote attacker can exploit this to read allocated or unallocated memory past the actual data when trying to parse a .phar file. (CVE-2018-20783) |
last seen | 2020-06-01 |
modified | 2020-06-02 |
plugin id | 119764 |
published | 2018-12-19 |
reporter | This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. |
source | https://www.tenable.com/plugins/nessus/119764 |
title | PHP 5.6.x < 5.6.39 Multiple vulnerabilities |
NASL family | Ubuntu Local Security Checks |
NASL id | UBUNTU_USN-4160-1.NASL |
description | It was discovered that UW IMAP incorrectly handled inputs. A remote attacker could possibly use this issue to execute arbitrary OS commands. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. |
last seen | 2020-06-01 |
modified | 2020-06-02 |
plugin id | 130149 |
published | 2019-10-22 |
reporter | Ubuntu Security Notice (C) 2019 Canonical, Inc. / NASL script (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof. |
source | https://www.tenable.com/plugins/nessus/130149 |
title | Ubuntu 16.04 LTS / 18.04 LTS / 19.04 : uw-imap vulnerability (USN-4160-1) |
NASL family | SuSE Local Security Checks |
NASL id | OPENSUSE-2018-1507.NASL |
description | This update for php7 fixes the following issues : Security issue fixed : - CVE-2018-19518: Fixed imap_open script injection flaw (bsc#1117107). This update was imported from the SUSE:SLE-12:Update update project. |
last seen | 2020-06-05 |
modified | 2018-12-11 |
plugin id | 119570 |
published | 2018-12-11 |
reporter | This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof. |
source | https://www.tenable.com/plugins/nessus/119570 |
title | openSUSE Security Update : php7 (openSUSE-2018-1507) |
NASL family | CGI abuses |
NASL id | PHP_7_2_13.NASL |
description | According to its banner, the version of PHP running on the remote web server is 7.2.x prior to 7.2.13. It is, therefore, affected by multiple vulnerabilities: - An arbitrary command injection vulnerability exists in the imap_open function due to improper filters for mailbox names prior to passing them to rsh or ssh commands. An authenticated, remote attacker can exploit this by sending a specially crafted IMAP server name to cause the execution of arbitrary commands on the target system. (CVE-2018-19518) - A heap buffer over-read exists in the phar_parse_pharfile function. An unauthenticated, remote attacker can exploit this to read allocated or unallocated memory past the actual data when trying to parse a .phar file. (CVE-2018-20783) |
last seen | 2020-06-01 |
modified | 2020-06-02 |
plugin id | 119766 |
published | 2018-12-19 |
reporter | This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. |
source | https://www.tenable.com/plugins/nessus/119766 |
title | PHP 7.2.x < 7.2.13 Multiple vulnerabilities |
NASL family | Gentoo Local Security Checks |
NASL id | GENTOO_GLSA-202003-57.NASL |
description | The remote host is affected by the vulnerability described in GLSA-202003-57 (PHP: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in PHP. Please review the CVE identifiers referenced below for details. Impact : An attacker could possibly execute arbitrary shell commands, cause a Denial of Service condition or obtain sensitive information. Workaround : There is no known workaround at this time. |
last seen | 2020-04-30 |
modified | 2020-03-27 |
plugin id | 134965 |
published | 2020-03-27 |
reporter | This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. |
source | https://www.tenable.com/plugins/nessus/134965 |
title | GLSA-202003-57 : PHP: Multiple vulnerabilities |
NASL family | SuSE Local Security Checks |
NASL id | OPENSUSE-2018-1506.NASL |
description | This update for php5 fixes the following issues : Security issue fixed : - CVE-2018-19518: Fixed imap_open script injection flaw (bsc#1117107). This update was imported from the SUSE:SLE-12:Update update project. |
last seen | 2020-06-05 |
modified | 2018-12-11 |
plugin id | 119569 |
published | 2018-12-11 |
reporter | This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof. |
source | https://www.tenable.com/plugins/nessus/119569 |
title | openSUSE Security Update : php5 (openSUSE-2018-1506) |
NASL family | CGI abuses |
NASL id | PHP_7_1_25.NASL |
description | According to its banner, the version of PHP running on the remote web server is 7.1.x prior to 7.1.25. It is, therefore, affected by multiple vulnerabilities: - An arbitrary command injection vulnerability exists in the imap_open function due to improper filters for mailbox names prior to passing them to rsh or ssh commands. An authenticated, remote attacker can exploit this by sending a specially crafted IMAP server name to cause the execution of arbitrary commands on the target system. (CVE-2018-19518) - A heap buffer over-read exists in the phar_parse_pharfile function. An unauthenticated, remote attacker can exploit this to read allocated or unallocated memory past the actual data when trying to parse a .phar file. (CVE-2018-20783) |
last seen | 2020-06-01 |
modified | 2020-06-02 |
plugin id | 119765 |
published | 2018-12-19 |
reporter | This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. |
source | https://www.tenable.com/plugins/nessus/119765 |
title | PHP 7.1.x < 7.1.25 Multiple vulnerabilities |
NASL family | CGI abuses |
NASL id | PHP_7_0_33.NASL |
description | According to its banner, the version of PHP running on the remote web server is 7.0.x prior to 7.0.33. It is, therefore, affected by multiple vulnerabilities: - An arbitrary command injection vulnerability exists in the imap_open function due to improper filters for mailbox names prior to passing them to rsh or ssh commands. An authenticated, remote attacker can exploit this by sending a specially crafted IMAP server name to cause the execution of arbitrary commands on the target system. (CVE-2018-19518) - A heap buffer over-read exists in the phar_parse_pharfile function. An unauthenticated, remote attacker can exploit this to read allocated or unallocated memory past the actual data when trying to parse a .phar file. (CVE-2018-20783) |
last seen | 2020-06-01 |
modified | 2020-06-02 |
plugin id | 122821 |
published | 2019-03-13 |
reporter | This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof. |
source | https://www.tenable.com/plugins/nessus/122821 |
title | PHP 7.0.x < 7.0.33 Multiple vulnerabilities |
NASL family | Fedora Local Security Checks |
NASL id | FEDORA_2018-7EBFE1E6F2.NASL |
description | **PHP version 7.2.13** (06 Dec 2018) **ftp:** - Fixed bug php#77151 (ftp_close(): SSL_read on shutdown). (Remi) **CLI:** - Fixed bug php#77111 (php-win.exe corrupts unicode symbols from cli parameters). (Anatol) **Fileinfo:** - Fixed bug php#77095 (slowness regression in 7.2/7.3 (compared to 7.1)). (Anatol) **iconv:** - Fixed bug php#77147 (Fixing 60494 ignored ICONV_MIME_DECODE_CONTINUE_ON_ERROR). (cmb) **Core:** - Fixed bug php#77231 (Segfault when using convert.quoted-printable-encode filter). (Stas) **IMAP:** - Fixed bug php#77153 (imap_open allows to run arbitrary shell commands via mailbox parameter). (Stas) **ODBC:** - Fixed bug php#77079 (odbc_fetch_object has incorrect type signature). (Jon Allen) **Opcache:** - Fixed bug php#77058 (Type inference in opcache causes side effects). (Nikita) - Fixed bug php#77092 (array_diff_key() - segmentation fault). (Nikita) **Phar:** - Fixed bug php#77022 (PharData always creates new files with mode 0666). (Stas) - Fixed bug php#77143 (Heap Buffer Overflow (READ: 4) in phar_parse_pharfile). (Stas) **PGSQL:** - Fixed bug php#77047 (pg_convert has a broken regex for the |
last seen | 2020-06-05 |
modified | 2019-01-03 |
plugin id | 120566 |
published | 2019-01-03 |
reporter | This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. |
source | https://www.tenable.com/plugins/nessus/120566 |
title | Fedora 29 : php (2018-7ebfe1e6f2) |
NASL family | Debian Local Security Checks |
NASL id | DEBIAN_DLA-1608.NASL |
description | Vulnerabilities have been discovered in php5, a server-side, HTML-embedded scripting language. Note that this update includes a change to the default behavior for IMAP connections. See below for details. CVE-2018-19518 An argument injection vulnerability in imap_open() may allow a remote attacker to execute arbitrary OS commands on the IMAP server. The fix for the CVE-2018-19518 vulnerability included this additional note from the upstream developers : Starting with 5.6.38, rsh/ssh logins are disabled by default. Use imap.enable_insecure_rsh if you want to enable them. Note that the IMAP library does not filter mailbox names before passing them to rsh/ssh command, thus passing untrusted data to this function with rsh/ssh enabled is insecure. CVE-2018-19935 A NULL pointer dereference leads to an application crash and a denial of service via an empty string in the message argument to the imap_mail function of ext/imap/php_imap.c. For Debian 8 |
last seen | 2020-06-01 |
modified | 2020-06-02 |
plugin id | 119695 |
published | 2018-12-17 |
reporter | This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. |
source | https://www.tenable.com/plugins/nessus/119695 |
title | Debian DLA-1608-1 : php5 security update |
NASL family | SuSE Local Security Checks |
NASL id | SUSE_SU-2018-3988-1.NASL |
description | This update for php7 fixes the following issues : Security issue fixed : CVE-2018-19518: Fixed imap_open script injection flaw (bsc#1117107). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. |
last seen | 2020-06-01 |
modified | 2020-06-02 |
plugin id | 120176 |
published | 2019-01-02 |
reporter | This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof. |
source | https://www.tenable.com/plugins/nessus/120176 |
title | SUSE SLES12 Security Update : Recommended update for php7 (SUSE-SU-2018:3988-1) |
NASL family | Fedora Local Security Checks |
NASL id | FEDORA_2018-DFE1F0BAC6.NASL |
description | **PHP version 7.2.13** (06 Dec 2018) **ftp:** - Fixed bug php#77151 (ftp_close(): SSL_read on shutdown). (Remi) **CLI:** - Fixed bug php#77111 (php-win.exe corrupts unicode symbols from cli parameters). (Anatol) **Fileinfo:** - Fixed bug php#77095 (slowness regression in 7.2/7.3 (compared to 7.1)). (Anatol) **iconv:** - Fixed bug php#77147 (Fixing 60494 ignored ICONV_MIME_DECODE_CONTINUE_ON_ERROR). (cmb) **Core:** - Fixed bug php#77231 (Segfault when using convert.quoted-printable-encode filter). (Stas) **IMAP:** - Fixed bug php#77153 (imap_open allows to run arbitrary shell commands via mailbox parameter). (Stas) **ODBC:** - Fixed bug php#77079 (odbc_fetch_object has incorrect type signature). (Jon Allen) **Opcache:** - Fixed bug php#77058 (Type inference in opcache causes side effects). (Nikita) - Fixed bug php#77092 (array_diff_key() - segmentation fault). (Nikita) **Phar:** - Fixed bug php#77022 (PharData always creates new files with mode 0666). (Stas) - Fixed bug php#77143 (Heap Buffer Overflow (READ: 4) in phar_parse_pharfile). (Stas) **PGSQL:** - Fixed bug php#77047 (pg_convert has a broken regex for the |
last seen | 2020-06-05 |
modified | 2019-01-03 |
plugin id | 120854 |
published | 2019-01-03 |
reporter | This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. |
source | https://www.tenable.com/plugins/nessus/120854 |
title | Fedora 28 : php (2018-dfe1f0bac6) |
NASL family | CGI abuses |
NASL id | PHP_7_3_0.NASL |
description | According to its banner, the version of PHP running on the remote web server is 7.3.0 [alpha|beta] prior to 7.3.0. It is, therefore, affected by multiple vulnerabilities: - An arbitrary command injection vulnerability exists in the imap_open function due to improper filters for mailbox names prior to passing them to rsh or ssh commands. An authenticated, remote attacker can exploit this by sending a specially crafted IMAP server name to cause the execution of arbitrary commands on the target system. (CVE-2018-19518) - A denial of service vulnerability exists in the imap_mail function due to improper data validation. An unauthenticated, remote attacker can exploit this via an empty string in the message argument to the imap_mail function to cause the application to stop responding. (CVE-2018-19935) - A heap buffer over-read exists in the phar_parse_pharfile function. An unauthenticated, remote attacker can exploit this to read allocated or unallocated memory past the actual data when trying to parse a .phar file. (CVE-2018-20783) |
last seen | 2020-06-01 |
modified | 2020-06-02 |
plugin id | 111217 |
published | 2018-07-20 |
reporter | This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. |
source | https://www.tenable.com/plugins/nessus/111217 |
title | PHP 7.3.0 [alpha|beta] < 7.3.0 Multiple vulnerabilities |
NASL family | SuSE Local Security Checks |
NASL id | SUSE_SU-2018-3995-1.NASL |
description | This update for php5 fixes the following issues : Security issue fixed : CVE-2018-19518: Fixed imap_open script injection flaw (bsc#1117107). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. |
last seen | 2020-06-01 |
modified | 2020-06-02 |
plugin id | 120177 |
published | 2019-01-02 |
reporter | This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof. |
source | https://www.tenable.com/plugins/nessus/120177 |
title | SUSE SLES12 Security Update : Recommended update for php5 (SUSE-SU-2018:3995-1) |
NASL family | Amazon Linux Local Security Checks |
NASL id | ALA_ALAS-2019-1147.NASL |
description | ext/imap/php_imap.c in PHP 5.x and 7.x before 7.3.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty string in the message argument to the imap_mail function.(CVE-2018-19935) University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh command (by means of the imap_rimap function in c-client/imap4r1.c and the tcp_aopen function in osdep/unix/tcp_unix.c) without preventing argument injection, which might allow remote attackers to execute arbitrary OS commands if the IMAP server name is untrusted input (e.g., entered by a user of a web application) and if rsh has been replaced by a program with different argument semantics. For example, if rsh is a link to ssh (as seen on Debian and Ubuntu systems), then the attack can use an IMAP server name containing a |
last seen | 2020-06-01 |
modified | 2020-06-02 |
plugin id | 121132 |
published | 2019-01-14 |
reporter | This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof. |
source | https://www.tenable.com/plugins/nessus/121132 |
title | Amazon Linux AMI : php56 / php70,php71,php72 (ALAS-2019-1147) |
Saint
bid | 106018 |
description | Horde Imp Unauthenticated Remote Command Execution |
title | horde_imp_rce |
type | remote |