Symfony Mailer SendmailTransport Argument Injection Vulnerability

A vulnerability exists in the Symfony Mailer component's SendmailTransport when used in '-t' mode. Prior to versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12, recipient addresses were added to the sendmail command line without a proper end-of-options separator. This oversight allowed addresses starting with a dash to be misinterpreted as command-line options instead of valid recipient addresses. The issue has been addressed by ensuring the correct separator is used before the list of recipients.

Impact

Exploitation of this vulnerability could lead to argument injection, where a recipient address is incorrectly processed as a command-line option by sendmail.

Reproduction

To reproduce this vulnerability, configure Symfony Mailer to use the SendmailTransport in '-t' mode. Send an email with a recipient address that begins with a dash. The absence of the '--' separator before the recipient addresses will cause sendmail to misinterpret the address as an option, demonstrating the vulnerability.

Remediation

Users can update to Symfony versions 5.4.52, 6.4.40, 7.4.12, or 8.0.12 to address this vulnerability.