CVE-2017-11516: Yii Cross-site Scripting Framework vulnerability
Summary
CVE-2017-11516: Yii Cross-site Scripting Framework vulnerability. Affects yiisoft/yii2-dev versions >= 2.0.12, < 2.0.13. Fixed in 2.0.13. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Yii Framework is a high-performance PHP framework for developing web applications. It provides a solid foundation for building robust and secure applications with features like MVC architecture, database abstraction, and security measures. The vulnerability affects Yii Framework version 2.0.12 and occurs in the exception screen when debug mode is enabled. This vulnerability arises due to mishandling of the $exception->errorInfo variable in the framework/views/errorHandler/exception.php file.
Vulnerability Detail
The vulnerability allows for cross-site scripting (XSS) attacks, which can lead to unauthorized execution of malicious scripts in a user's browser. When debug mode is enabled, the exception screen displays detailed error information, including the $exception->errorInfo variable. However, this variable is not properly sanitized, allowing an attacker to inject malicious code that will be executed when the exception screen is rendered. This can result in various consequences, such as stealing sensitive user information, performing actions on behalf of the user, or defacing the application.
How To Fix
Minimum fixed version
2.0.13
This is the first release that contains the fix.
composer require yiisoft/yii2-dev:2.0.13Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by manually sanitizing the $exception->errorInfo variable in the exception.php file. The variable should be properly escaped or filtered to prevent the execution of malicious scripts. Here is an example of how the variable can be sanitized:
$errorInfo = htmlspecialchars($exception->errorInfo, ENT_QUOTES, 'UTF-8');
This code snippet uses the htmlspecialchars function to convert special characters to their HTML entities, ensuring that any injected scripts are rendered as plain text and not executed.
Conclusion
The Yii Framework version 2.0.12 is vulnerable to a cross-site scripting (XSS) attack when debug mode is enabled. This can lead to the execution of malicious scripts in a user's browser, potentially compromising sensitive information or defacing the application. To fix the vulnerability, it is recommended to upgrade to Yii Framework version 2.0.13 or higher. If immediate upgrade is not possible, manually sanitizing the $exception->errorInfo variable can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for yiisoft/yii2-dev →
FAQ
The vulnerability allows an attacker to execute arbitrary scripts in a user's browser, potentially leading to unauthorized access, data theft, or application defacement.
No, the vulnerability only affects applications with debug mode enabled. However, it is still recommended to apply the patch as a preventive measure.
There are no known public exploits for this vulnerability at the time of this report. However, it is crucial to address the issue promptly to mitigate the risk of potential attacks.
While a WAF can help mitigate certain types of XSS attacks, it is not a foolproof solution. It is recommended to apply the patch or upgrade to the latest version of Yii Framework to address the root cause of the vulnerability.
You can find more information about the security updates and the patch for this vulnerability in the official Yii Framework documentation or the GitHub advisory database.
References
Related vulnerabilities
Recent vulnerabilities recorded for yiisoft/yii2-dev.
