CVE-2012-3363: Zend Framework XXE Vulnerability
Summary
CVE-2012-3363: Zend Framework XXE Vulnerability. Affects zendframework/zendframework1 across 2 version ranges.
>= 1.0.0, < 1.11.12
>= 1.12.0-rc1, < 1.12.0
Fixed in 1.11.12 or 1.12.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Zend Framework is a popular open-source PHP framework that provides a collection of professional PHP packages for developing web applications. It offers a wide range of features and components for building robust and secure applications. However, versions 1.x before 1.11.12 and 1.12.x before 1.12.0 of Zend Framework are vulnerable to an XML external entity (XXE) injection attack.
Vulnerability Detail
The vulnerability, identified as CVE-2012-3363, resides in the Zend_XmlRpc component of Zend Framework. It arises due to improper handling of SimpleXMLElement classes. An attacker can exploit this vulnerability by sending a specially crafted XML-RPC request containing a malicious external entity reference in a DOCTYPE element. This can lead to the disclosure of arbitrary files or the creation of TCP connections, potentially enabling further attacks. The vulnerability has a moderate severity rating and is classified under CWE-611.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.0.0, < 1.11.121.11.12composer require zendframework/zendframework1:1.11.12 -
>= 1.12.0-rc1, < 1.12.01.12.0composer require zendframework/zendframework1:1.12.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, developers can disable external entity expansion in the XML parser used by Zend Framework. This can be achieved by modifying the XML parser configuration to disallow the resolution of external entities. Here is an example of how to disable external entity expansion in PHP:
libxml_disable_entity_loader(true);
Conclusion
In conclusion, the Zend Framework XXE vulnerability (CVE-2012-3363) affects versions 1.x before 1.11.12 and 1.12.x before 1.12.0. It allows remote attackers to read arbitrary files or create TCP connections by exploiting the improper handling of SimpleXMLElement classes. To mitigate this vulnerability, it is crucial to upgrade to the fixed versions of Zend Framework or apply the provided workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for zendframework/zendframework1 →
FAQ
Zend Framework is an open-source PHP framework that provides a collection of professional PHP packages for developing web applications. It offers a wide range of features and components for building robust and secure applications.
An XML external entity (XXE) injection attack is a type of vulnerability that allows an attacker to exploit the processing of XML input to disclose sensitive information, perform server-side request forgery (SSRF), or execute arbitrary code. In the case of this vulnerability, it enables the attacker to read arbitrary files or create TCP connections.
This vulnerability has a moderate severity rating. While it can lead to the disclosure of arbitrary files or the creation of TCP connections, its impact may vary depending on the specific context and configuration of the affected application.
To fix this vulnerability, it is recommended to upgrade to a fixed version of Zend Framework. For versions 1.x, upgrade to version 1.11.12 or later. For versions 1.12.x, upgrade to version 1.12.0 or later. These fixed versions address the issue by implementing proper handling of SimpleXMLElement classes.
Yes, as a temporary workaround, you can disable external entity expansion in the XML parser used by Zend Framework. This can be achieved by modifying the XML parser configuration to disallow the resolution of external entities.
Related vulnerabilities
Recent vulnerabilities recorded for zendframework/zendframework1.
