{"action":"created","issue":{"url":"https://api.github.com/repos/zetacomponents/Mail/issues/58","repository_url":"https://api.github.com/repos/zetacomponents/Mail","labels_url":"https://api.github.com/repos/zetacomponents/Mail/issues/58/labels{/name}","comments_url":"https://api.github.com/repos/zetacomponents/Mail/issues/58/comments","events_url":"https://api.github.com/repos/zetacomponents/Mail/issues/58/events","html_url":"https://github.com/zetacomponents/Mail/issues/58","id":267860873,"number":58,"title":"Restrict characters that can be used for the returnPath property of ezcMail (CVE-2017-15806)","user":{"login":"Kay-MalwareBenchmark","id":33020407,"avatar_url":"https://avatars0.githubusercontent.com/u/33020407?v=4","gravatar_id":"","url":"https://api.github.com/users/Kay-MalwareBenchmark","html_url":"https://github.com/Kay-MalwareBenchmark","followers_url":"https://api.github.com/users/Kay-MalwareBenchmark/followers","following_url":"https://api.github.com/users/Kay-MalwareBenchmark/following{/other_user}","gists_url":"https://api.github.com/users/Kay-MalwareBenchmark/gists{/gist_id}","starred_url":"https://api.github.com/users/Kay-MalwareBenchmark/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Kay-MalwareBenchmark/subscriptions","organizations_url":"https://api.github.com/users/Kay-MalwareBenchmark/orgs","repos_url":"https://api.github.com/users/Kay-MalwareBenchmark/repos","events_url":"https://api.github.com/users/Kay-MalwareBenchmark/events{/privacy}","received_events_url":"https://api.github.com/users/Kay-MalwareBenchmark/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2017-10-24T00:40:55Z","updated_at":"2017-11-12T13:27:18Z","closed_at":null,"author_association":"NONE","body":"A critical remote code execution vulnerability has been discovered in current version. Please contact me at «email address removed» for more details."},"comment":{"url":"https://api.github.com/repos/zetacomponents/Mail/issues/comments/343737226","html_url":"https://github.com/zetacomponents/Mail/issues/58#issuecomment-343737226","issue_url":"https://api.github.com/repos/zetacomponents/Mail/issues/58","id":343737226,"user":{"login":"Kay-MalwareBenchmark","id":33020407,"avatar_url":"https://avatars0.githubusercontent.com/u/33020407?v=4","gravatar_id":"","url":"https://api.github.com/users/Kay-MalwareBenchmark","html_url":"https://github.com/Kay-MalwareBenchmark","followers_url":"https://api.github.com/users/Kay-MalwareBenchmark/followers","following_url":"https://api.github.com/users/Kay-MalwareBenchmark/following{/other_user}","gists_url":"https://api.github.com/users/Kay-MalwareBenchmark/gists{/gist_id}","starred_url":"https://api.github.com/users/Kay-MalwareBenchmark/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Kay-MalwareBenchmark/subscriptions","organizations_url":"https://api.github.com/users/Kay-MalwareBenchmark/orgs","repos_url":"https://api.github.com/users/Kay-MalwareBenchmark/repos","events_url":"https://api.github.com/users/Kay-MalwareBenchmark/events{/privacy}","received_events_url":"https://api.github.com/users/Kay-MalwareBenchmark/received_events","type":"User","site_admin":false},"created_at":"2017-11-12T13:27:18Z","updated_at":"2017-11-12T13:27:18Z","author_association":"NONE","body":"Right, escaping returnPath in Mail library might be much safer😆\n\n> 在 2017年11月12日，下午9:20，Derick Rethans <notifications@github.com> 写道：\n> \n> After investigating this, it is indeed possible to pass arbitrary parameters to the \"sendmail\" binary when setting the returnPath property of ezcMail when using the ezcMailMtaTransport. In some situations, it is possible to use an e-mail address that contains -X/path/to/wwwroot/file.php\" to write a file to the file system, that can then be accessed and run through domainname/file.php.\n> \n> This is only possible if all of these conditions are true:\n> \n> you use the ezcMailMtaTransport\n> your \"sendmail\" binary allows the -X flag to be set, which is not the case for exim4 and postfix, as they don't support that argument\n> your wwwroot is writable by the user your webserver is running at\n> the input to use for the ezcMailAddress that is assigned to the returnPath property is not properly escaped\n> —\n> You are receiving this because you authored the thread.\n> Reply to this email directly, view it on GitHub <https://github.com/zetacomponents/Mail/issues/58#issuecomment-343736864>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AffZ9wTi7khPfTgKojnzh-cwzSt4Vsl0ks5s1vCugaJpZM4QDr1f>.\n> \n\n"}}
{"actor":{"display_login":"Kay-MalwareBenchmark"}}