CIVI-SA-2013-006 - html2text PHP code execution

html2text is a library which converts HTML documents to plain-text documents. CiviMail uses html2text to convert HTML email messages to plain-text email messages. A bug in the processing of certain HTML tags causes html2text to evaluate PHP code from the HTML document. Any authenticated staff user with permission to send email (e.g. permission "access CiviMail") can therefore execute PHP code.

This vulnerability is mitigated by the following factors:

• The vulnerability requires permission to send email through the CiviCRM backend.
• The interfaces for composing HTML email messages are protected against cross-site request forgery; therefore, exploiting this vulnerability requires user interaction.
• All form submissions are heuristically checked for suspicious inputs (such as embedded PHP or JavaScript) using PHPIDS.
• Email text generated via token (e.g. "{contact.first_name}") is not evaluated with html2text; therefore, untrusted contact data (such as "first name" or "last name") cannot be used as a vector of attack.