CVE-2014-8088: Zend Access Restriction Bypass in zendframework/zendframework
Summary
CVE-2014-8088: Zend Access Restriction Bypass. Affects zendframework/zendframework across 4 version ranges.
>= 2.0.0, < 2.0.99
>= 2.1.0, < 2.1.99
>= 2.2.0, < 2.2.8
>= 2.3.0, < 2.3.3
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Zend Framework is an open-source PHP framework that provides a collection of professional PHP packages for developing web applications. The Zend_Ldap class in Zend before 1.12.9 and the Zend\Ldap component in Zend 2.x before 2.2.8 and 2.3.x before 2.3.3 are vulnerable to an access restriction bypass. This vulnerability allows remote attackers to bypass authentication by using a password that starts with a null byte, triggering an unauthenticated bind.
Vulnerability Detail
The vulnerability in Zend Framework allows an attacker to bypass authentication by exploiting a flaw in the handling of passwords starting with a null byte. By sending a specially crafted password, an attacker can trigger an unauthenticated bind, effectively bypassing the authentication process. This can lead to unauthorized access to sensitive information or actions within the affected application.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.0.0, < 2.0.992.0.99composer require zendframework/zendframework:2.0.99 -
>= 2.1.0, < 2.1.992.1.99composer require zendframework/zendframework:2.1.99 -
>= 2.2.0, < 2.2.82.2.8composer require zendframework/zendframework:2.2.8 -
>= 2.3.0, < 2.3.32.3.3composer require zendframework/zendframework:2.3.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed versions as mentioned in the 'how_to_fix' section.
Conclusion
The Zend Access Restriction Bypass vulnerability in zendframework/zendframework allows remote attackers to bypass authentication, potentially leading to unauthorized access to sensitive information or actions within the affected application. It is crucial to upgrade to the fixed versions mentioned in the 'how_to_fix' section to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for zendframework/zendframework →
FAQ
This vulnerability allows remote attackers to bypass authentication, potentially leading to unauthorized access to sensitive information or actions within the affected application.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. It analyzes your composer.lock file and provides real-time alerts for open-source vulnerabilities.
There are no known public exploits for this vulnerability at the time of writing. However, it is important to patch your application to prevent potential exploitation.
No, upgrading to the fixed versions is the recommended approach to mitigate the risk associated with this vulnerability.
You can find more information about this vulnerability in the GitHub Advisory Database (https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-f6rc-rh43-h8gr/GHSA-f6rc-rh43-h8gr.json).
Related vulnerabilities
Recent vulnerabilities recorded for zendframework/zendframework.
