CVE-2014-8684: CodeIgniter and Kohana vulnerable to PHP Object Injection
Summary
CVE-2014-8684: CodeIgniter and Kohana vulnerable to PHP Object Injection. Affects codeigniter/framework versions < 3.0.0. Fixed in 3.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
CodeIgniter is a popular PHP framework used for developing web applications. It provides a set of libraries and tools that simplify the development process. Kohana is another PHP framework that follows the same principles as CodeIgniter. Both frameworks are widely used and have a large user base. However, they are vulnerable to a PHP object injection vulnerability, which can be exploited by remote attackers to spoof session cookies and conduct PHP object injection attacks. This vulnerability exists in CodeIgniter versions before 3.0 and Kohana versions 3.2.3 and earlier, as well as versions 3.3.x through 3.3.2.
Vulnerability Detail
The vulnerability arises due to the use of standard string comparison operators to compare cryptographic hashes. This makes it easier for remote attackers to manipulate session cookies and inject malicious PHP objects. By exploiting this vulnerability, an attacker can execute arbitrary code on the server, potentially leading to unauthorized access, data leakage, or other malicious activities.
How To Fix
Minimum fixed version
3.0.0
This is the first release that contains the fix.
composer require codeigniter/framework:3.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the affected frameworks to the latest secure versions as soon as possible.
Conclusion
CodeIgniter and Kohana are vulnerable to a PHP object injection vulnerability that can be exploited by remote attackers. It is essential to update the affected frameworks to the latest secure versions to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for codeigniter/framework →
FAQ
CodeIgniter is a PHP framework used for developing web applications. It provides a set of libraries and tools that simplify the development process.
Kohana is a PHP framework that follows the same principles as CodeIgniter. It is widely used for developing web applications.
PHP object injection is a vulnerability that allows an attacker to inject malicious PHP objects into an application. This can lead to arbitrary code execution and other security issues.
The potential consequences of this vulnerability include unauthorized access to sensitive data, data leakage, and the execution of arbitrary code on the server.
To protect your application, it is crucial to update CodeIgniter to version 3.0.0 or later and Kohana to version 3.3.3 or later. Additionally, following secure coding practices and regularly updating your software can help mitigate the risk of PHP object injection vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for codeigniter/framework.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
