CVE-2012-2966: Caucho Quercus in Resin Vulnerability Leading to SERVER Array Overwrite
Summary
CVE-2012-2966: Caucho Quercus, as distributed in Resin before 4.0.29, overwrites entries in the SERVER superglobal array on the basis of POST parameters, which has unspecified impact and remote attack vectors. Affects com.caucho:resin versions < 4.0.29. Fixed in 4.0.29. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Caucho Quercus is a Java-based implementation of the PHP language, primarily used within the Resin application server. It allows developers to run PHP applications on a Java platform, providing benefits such as performance and scalability. However, prior to version 4.0.29, Quercus had a significant vulnerability where it could overwrite entries in the SERVER superglobal array based on POST parameters, potentially leading to unauthorized access or manipulation of server variables.
Vulnerability Detail
The vulnerability arises from the way Caucho Quercus handles POST parameters. Specifically, it allows POST data to overwrite entries in the SERVER superglobal array, which can lead to unintended consequences such as exposing sensitive information or allowing remote attackers to manipulate server behavior. This issue was present in versions of Resin before 4.0.29 and is classified as having a high severity due to its potential impact on application security.
How To Fix
Minimum fixed version
4.0.29
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation on POST parameters to prevent them from overwriting sensitive server variables. This can be done by sanitizing input data before processing it within your application.
Conclusion
Caucho Quercus has a critical vulnerability that can lead to the overwriting of the SERVER superglobal array based on POST parameters. It is essential to update to version 4.0.29 or later to secure your application. Additionally, using tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for com.caucho:resin →
FAQ
The impact includes potential unauthorized access to server variables and manipulation of application behavior, which can lead to security breaches.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Versions of Resin prior to 4.0.29 are affected by this vulnerability.
Yes, the patch is included in version 4.0.29 and later of the Caucho Quercus package.
Implement input validation on POST parameters to mitigate the risk of overwriting sensitive server variables.
Related vulnerabilities
Recent vulnerabilities recorded for com.caucho:resin.
