CVE-2021-3603: 
PHP vulnerability analysis and mitigation

PHPMailer versions 6.4.1 and earlier contain a vulnerability (CVE-2021-3603) that could result in untrusted code being called if such code is injected into the host project's scope by other means. The vulnerability was discovered in the validateAddress() function where if the $patternselect parameter is set to 'php' (the default value defined by static::$validator), and the global namespace contains a function called 'php', it would be called in preference to the built-in validator of the same name (PHPMailer GitHub, Ubuntu Security).

The vulnerability exists in the validateAddress() function's handling of callables. When a string-based callable matches the name of a built-in validator ('php', 'pcre', 'pcre8', 'html5'), the system would incorrectly prioritize the global namespace function over the built-in validator. This issue was patched in PHPMailer 6.5.0 by denying the use of simple strings as validator function names (PHPMailer GitHub).

If exploited, this vulnerability could allow an attacker to execute arbitrary code through the injection of malicious functions into the global namespace that match the names of built-in validators (Fedora Update).

The vulnerability requires the attacker to first inject code into the host project's scope. The exploit specifically targets the validateAddress() function when using the default 'php' validator pattern (PHPMailer GitHub).

The vulnerability was patched in PHPMailer 6.5.0. The fix includes denying the use of simple strings as validator function names. Users who need to inject their own validator should provide a closure instead of a function name. Organizations should upgrade to PHPMailer version 6.5.0 or later to address this security issue (PHPMailer GitHub).