CVE-2012-6532: Zend Framework XEE Vulnerability
Summary
CVE-2012-6532: Zend Framework XEE Vulnerability. Affects zendframework/zendframework1 across 2 version ranges.
>= 1.0, < 1.11.13
>= 1.12.0-rc1, < 1.12.0
Fixed in 1.11.13 or 1.12.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Zend Framework is an open-source web application framework implemented in PHP. It provides a collection of professional PHP packages for developing web applications. The vulnerability affects versions 1.x before 1.11.13 and 1.12.x before 1.12.0 of the Zend Framework. The vulnerable components include Zend_Dom, Zend_Feed, Zend_Soap, and Zend_XmlRpc. These components allow remote attackers to cause a denial of service (CPU consumption) by exploiting recursive or circular references in an XML entity definition in an XML DOCTYPE declaration. This type of attack is known as an XML Entity Expansion (XEE) attack.
Vulnerability Detail
The vulnerability arises due to insufficient input validation in the affected components of the Zend Framework. By crafting a malicious XML file with recursive or circular references in the XML DOCTYPE declaration, an attacker can trigger excessive CPU consumption, leading to a denial of service condition. This vulnerability can be exploited remotely, and the impact is limited to excessive CPU usage, potentially affecting the availability of the affected application.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.0, < 1.11.131.11.13composer require zendframework/zendframework1:1.11.13 -
>= 1.12.0-rc1, < 1.12.01.12.0composer require zendframework/zendframework1:1.12.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a fixed version is not immediately feasible, a temporary workaround can be implemented by disabling the affected components (Zend_Dom, Zend_Feed, Zend_Soap, and Zend_XmlRpc) or by implementing input validation to prevent the exploitation of XEE attacks. However, it is strongly recommended to upgrade to a fixed version as soon as possible.
Conclusion
The Zend Framework XEE vulnerability (CVE-2012-6532) allows remote attackers to cause a denial of service by exploiting recursive or circular references in XML entity definitions. To mitigate this vulnerability, it is crucial to upgrade to a fixed version of the Zend Framework. If immediate upgrade is not possible, implementing a temporary workaround and performing input validation can provide some protection. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for zendframework/zendframework1 →
FAQ
The vulnerability can cause a denial of service condition by consuming excessive CPU resources, potentially affecting the availability of the affected application.
Yes, this vulnerability can be exploited remotely.
No, only versions 1.x before 1.11.13 and 1.12.x before 1.12.0 are affected.
Yes, a temporary workaround is to disable the affected components or implement input validation to prevent XEE attacks. However, upgrading to a fixed version is strongly recommended.
You can use Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for zendframework/zendframework1.
