CVE-2015-3154: CRLF Injection Vulnerability in Zend Framework
Summary
CVE-2015-3154: Zenario CMS vulnerable to CRLF injection. Affects zendframework/zend-http across 3 version ranges.
< 1.12.12
>= 2.0.0beta4, < 2.3.8
>= 2.4.0rc1, < 2.4.1
Fixed in 1.12.12, 2.3.8 or 2.4.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Zend Framework is a popular PHP framework that provides a collection of professional PHP packages for developing web applications. It offers a wide range of features and components to facilitate the development process. However, versions before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 are vulnerable to a CRLF injection vulnerability in Zend\Mail (Zend_Mail) component. This vulnerability allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks by exploiting CRLF sequences in the header of an email.
Vulnerability Detail
The CRLF injection vulnerability in Zend Framework allows an attacker to manipulate the HTTP response by injecting arbitrary headers. By inserting CRLF sequences in the email header, an attacker can control the response and potentially perform various attacks, such as cross-site scripting (XSS), session fixation, cache poisoning, or phishing attacks. This vulnerability can lead to serious security breaches and compromise the integrity and confidentiality of the affected application.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.12.121.12.12composer require zendframework/zend-http:1.12.12 -
>= 2.0.0beta4, < 2.3.82.3.8composer require zendframework/zend-http:2.3.8 -
>= 2.4.0rc1, < 2.4.12.4.1composer require zendframework/zend-http:2.4.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the Zend Framework to the latest secure version as soon as possible.
Conclusion
The CRLF injection vulnerability in Zend Framework can have severe consequences, including the compromise of application integrity and confidentiality. It is crucial to update the framework to the latest secure version to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for zendframework/zend-http →
FAQ
A CRLF injection vulnerability allows an attacker to manipulate the HTTP response by injecting arbitrary headers using CRLF sequences.
This vulnerability can lead to various attacks, including cross-site scripting (XSS), session fixation, cache poisoning, or phishing attacks.
Versions before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 are vulnerable to this CRLF injection vulnerability.
No, there is no known workaround. It is essential to update the Zend Framework to the latest secure version.
To fix this vulnerability, you need to upgrade to the latest version of Zend Framework. For versions 1.x, upgrade to version 1.12.12 or later. For versions 2.x, upgrade to version 2.3.8 or later. For versions 2.4.x, upgrade to version 2.4.1 or later.
Related vulnerabilities
Recent vulnerabilities recorded for zendframework/zend-http.
