CVE-2017-16880: filp/whoops - Cross-site Scripting vulnerability
Summary
CVE-2017-16880: filp whoops Cross-site Scripting vulnerability. Affects filp/whoops versions < 2.1.13. Fixed in 2.1.13. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
filp/whoops is a package available on Packagist that provides a nice and friendly error page when an error occurs in a PHP application. It is commonly used for debugging purposes and provides useful information to developers. However, versions before 2.1.13 of filp/whoops are vulnerable to a Cross-site Scripting (XSS) attack.
Vulnerability Detail
The vulnerability exists in the Util/TemplateHelper.php file of filp/whoops. The dump function in this file does not properly sanitize user input, allowing an attacker to inject malicious scripts into the error page. This can lead to the execution of arbitrary JavaScript code in the context of the victim's browser, potentially leading to session hijacking, data theft, or other malicious activities.
How To Fix
Minimum fixed version
2.1.13
This is the first release that contains the fix.
composer require filp/whoops:2.1.13Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are unable to immediately update filp/whoops to the fixed version, you can apply a temporary workaround by manually sanitizing user input before passing it to the dump function. Here's an example of how you can sanitize user input using the htmlspecialchars function in PHP:
$input = $_GET['input'];
$sanitizedInput = htmlspecialchars($input, ENT_QUOTES, 'UTF-8');
// Pass the sanitized input to the dump function
dump($sanitizedInput);
By properly sanitizing user input, you can prevent the execution of malicious scripts and mitigate the risk of XSS attacks.
Conclusion
The Cross-site Scripting vulnerability in filp/whoops before version 2.1.13 can allow an attacker to execute arbitrary JavaScript code in the context of a victim's browser. It is recommended to update the package to the latest version to fix this vulnerability. If immediate update is not possible, applying input sanitization can provide temporary mitigation. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for filp/whoops →
FAQ
filp/whoops is a package that provides a friendly error page for PHP applications. It helps developers debug their code by displaying detailed error information.
Cross-site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to the execution of arbitrary code in the victim's browser.
The vulnerability in filp/whoops allows an attacker to inject and execute arbitrary JavaScript code in the context of the victim's browser. This can lead to various malicious activities, such as session hijacking, data theft, or defacement of the error page.
To fix this vulnerability, you should update filp/whoops to version 2.1.13 or later. This version includes the necessary fixes to prevent the XSS attack. You can update the package by running composer update filp/whoops.
If you are unable to immediately update filp/whoops to the fixed version, you can manually sanitize user input before passing it to the dump function. This can help mitigate the risk of XSS attacks.
