CVE-2021-3603: PHPMailer RCE Vulnerability

CVE-2021-3603 Overview

CVE-2021-3603 is a code injection vulnerability affecting PHPMailer versions 6.4.1 and earlier. The vulnerability exists in the validateAddress() function where the $patternselect parameter, when set to the default value 'php', can be hijacked by a malicious function of the same name injected into the global namespace. If an attacker can inject a function called php into the host project's scope through other means, that malicious function will be called in preference to PHPMailer's built-in validator.

Critical Impact

Successful exploitation allows execution of arbitrary untrusted code if attackers can inject a function named 'php' into the global namespace, potentially leading to complete application compromise.

Affected Products

• PHPMailer versions up to and including 6.4.1
• Fedora 33 (via PHPMailer packages)
• Fedora 34 (via PHPMailer packages)

Discovery Timeline

• 2021-06-17 - CVE-2021-3603 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-3603

Vulnerability Analysis

This vulnerability stems from PHP's callable resolution behavior combined with PHPMailer's validation logic. When validateAddress() is called with the default $patternselect value of 'php', the function checks if this string is callable. In PHP, if a function named 'php' exists in the global namespace, it will be treated as callable and invoked instead of PHPMailer's intended built-in validation logic.

The attack requires a precondition where malicious code has already been injected into the application's global namespace (through a separate vulnerability or compromise). Once such code defines a function called php, any subsequent email address validation through PHPMailer will execute that attacker-controlled function with the email address as an argument.

Root Cause

The root cause is CWE-829: Inclusion of Functionality from Untrusted Control Sphere. PHPMailer's validation logic used simple string-based callable detection without properly restricting function resolution to its own namespace. The is_callable() check in PHP returns true for any string that matches a defined function name in the global scope, allowing external code to override expected behavior.

Attack Vector

The vulnerability is exploited over the network when applications using vulnerable PHPMailer versions process user-supplied email addresses. The attack chain requires:

1. An attacker first injects a malicious php function into the application's global namespace (via a separate code injection vulnerability, autoloader poisoning, or compromised dependency)
2. When PHPMailer's validateAddress() is called with the default validator setting
3. PHP's callable resolution finds the attacker's php function
4. The malicious function executes with the email address parameter, potentially leading to further code execution

The security patch in PHPMailer 6.5.0 addresses this by denying the use of simple strings as validator function names entirely:

         if (null === $patternselect) {
             $patternselect = static::$validator;
         }
-        //Don't allow overriding built-in validators with callables
-        if (
-            is_callable($patternselect) &&
-            //It's callable and not a string, or it's a string callable that's not a built-in pattern
-            (!is_string($patternselect) || !in_array(strtolower($patternselect), ['php', 'pcre', 'pcre8', 'html5']))
-        ) {
+        //Don't allow strings as callables, see SECURITY.md and CVE-2021-3603
+        if (is_callable($patternselect) && !is_string($patternselect)) {
             return call_user_func($patternselect, $address);
         }
         //Reject line breaks in addresses; it's valid RFC5322, but not RFC5321

Source: GitHub Commit 45f3c18

Detection Methods for CVE-2021-3603

Indicators of Compromise

• Presence of unexpected function definitions named php in application code or included files
• Unusual autoloader behavior or modified Composer files introducing rogue dependencies
• Unexpected code execution patterns during email validation operations
• Web application logs showing anomalous behavior when processing email addresses

Detection Strategies

• Scan deployed applications for PHPMailer versions prior to 6.5.0 using dependency scanning tools
• Monitor for unauthorized function definitions in the global namespace, particularly functions named php, pcre, pcre8, or html5
• Implement static code analysis to detect potential namespace pollution vulnerabilities
• Review application logs for unusual email validation failures or exceptions

Monitoring Recommendations

• Enable PHP error logging to capture unexpected function calls during email operations
• Implement file integrity monitoring on application codebases to detect injected functions
• Use runtime application self-protection (RASP) solutions to monitor callable invocations
• Set up alerts for changes to Composer lock files or autoloader configurations

How to Mitigate CVE-2021-3603

Immediate Actions Required

• Upgrade PHPMailer to version 6.5.0 or later immediately
• Audit your application's global namespace for any unexpected function definitions
• Review all dependencies and third-party code that may inject functions into the global namespace
• Implement strict autoloading practices to prevent namespace pollution

Patch Information

The vulnerability was mitigated in PHPMailer 6.5.0 by fundamentally changing how validator function names are handled. The fix denies the use of simple strings as validator function names altogether, only allowing non-string callables (such as closures or arrays representing object methods). This prevents any possibility of global namespace function hijacking. The security patch is available via the official PHPMailer GitHub repository. Fedora users should apply updates from the Fedora package announcements.

Workarounds

• If immediate upgrade is not possible, explicitly set a non-string validator callable in your PHPMailer configuration
• Implement namespace isolation by wrapping PHPMailer usage in a dedicated namespace
• Add runtime checks to verify no rogue php function exists before calling validateAddress()
• Consider using the 'pcre8' or 'html5' validators with explicit namespace prefixes as temporary mitigation

# Update PHPMailer via Composer
composer require phpmailer/phpmailer:^6.5.0

# Verify installed version
composer show phpmailer/phpmailer | grep versions