CVE-2012-5657: Zend Framework XXE Vulnerability
Summary
CVE-2012-5657: Zend Framework XXE Vulnerability. Affects zendframework/zendframework1 across 2 version ranges.
< 1.11.15
>= 1.12.0-rc1, < 1.12.1
Fixed in 1.11.15 or 1.12.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Zend Framework is a popular open-source PHP framework that provides a collection of professional PHP packages for developing web applications. It offers a wide range of features and components to facilitate the development process. However, versions 1.11.x before 1.11.15 and 1.12.x before 1.12.1 of Zend Framework are vulnerable to an XML External Entity (XXE) attack in the Zend_Feed_Rss and Zend_Feed_Atom classes. This vulnerability allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, and potentially cause a denial of service by consuming excessive CPU and memory resources.
Vulnerability Detail
The XXE vulnerability in Zend Framework allows an attacker to exploit the XML parsing functionality in the Zend_Feed_Rss and Zend_Feed_Atom classes. By crafting a malicious XML file, an attacker can include external entities that reference arbitrary files on the server. This can lead to the disclosure of sensitive information contained in those files. Additionally, the attacker can send HTTP requests to internal servers, potentially bypassing security measures and accessing sensitive resources. Furthermore, the excessive CPU and memory consumption caused by the attack can result in a denial of service condition.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.11.151.11.15composer require zendframework/zendframework1:1.11.15 -
>= 1.12.0-rc1, < 1.12.11.12.1composer require zendframework/zendframework1:1.12.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, developers can disable the XML entity expansion feature in the affected classes. This can be achieved by modifying the code to remove or comment out the relevant code sections responsible for XML parsing and entity expansion. However, this workaround may impact the functionality of the application and is not recommended as a long-term solution. It is strongly advised to apply the official patches or upgrade to the fixed versions of Zend Framework.
Conclusion
The XXE vulnerability in Zend Framework can have serious security implications, allowing attackers to access sensitive files, bypass security measures, and cause denial of service. It is crucial to apply the necessary patches or upgrade to the fixed versions to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for zendframework/zendframework1 →
FAQ
Zend Framework is an open-source PHP framework that provides a collection of professional PHP packages for developing web applications. It offers a wide range of features and components to facilitate the development process.
Versions 1.11.x before 1.11.15 and 1.12.x before 1.12.1 of Zend Framework are affected by this vulnerability.
An XML External Entity (XXE) attack is a type of attack that exploits vulnerabilities in XML parsers. By including external entities in XML input, an attacker can read arbitrary files, send HTTP requests to internal servers, and cause a denial of service.
This vulnerability allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, and potentially cause a denial of service by consuming excessive CPU and memory resources.
To fix this vulnerability, it is recommended to upgrade to the patched versions of Zend Framework. For versions 1.11.x, upgrade to version 1.11.15 or later. For versions 1.12.x, upgrade to version 1.12.1 or later.
Related vulnerabilities
Recent vulnerabilities recorded for zendframework/zendframework1.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
