Mitigating PHP2Shell: Everything You Need to Know
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability description explicitly points to the findPreview function in src/Controller/MailPreviewController.php as the location where the previewName value is accepted and passed to constructor execution. The provided commit information for both versions (4.x and 5.x) clearly shows the patches applied to this specific function. The patches introduce two key security checks:
previewName values containing namespace separators (\). This directly addresses the 'without rejecting namespace separators' part of the vulnerability.is_subclass_of to ensure that the resolved class extends DebugKit\Mailer\MailPreview. This addresses the 'without verifying that the class extends DebugKit\Mailer\MailPreview' part.These changes confirm that the MailPreviewController::findPreview function, in its state prior to these patches, was the direct point of vulnerability, allowing for unsafe reflection and arbitrary constructor execution due to insufficient input validation and type checking. An attacker would trigger this vulnerability by crafting a malicious previewName that would be processed by this function.
MailPreviewController::findPreviewsrc/Controller/MailPreviewController.php
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| cakephp/debug_kit | composer | < 4.10.3 | 4.10.3 |
| cakephp/debug_kit | composer | >= 5.0.0, < 5.2.4 | 5.2.4 |