CVE-2018-8073: yii2-redis Potential Remote code execution
Summary
CVE-2018-8073: yii2-redis Potential Remote code execution. Affects yiisoft/yii2-redis versions < 2.0.8. Fixed in 2.0.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The yii2-redis package is a Redis extension for the Yii framework, which provides an ActiveRecord implementation for Redis. It allows developers to interact with Redis databases using Yii's ActiveRecord pattern. Redis is an open-source in-memory data structure store that can be used as a database, cache, and message broker. It is commonly used for caching and session storage in web applications.
Vulnerability Detail
The vulnerability identified as CVE-2018-8073 in the yii2-redis package allows for potential remote code execution in the LUA context of the Redis server. This vulnerability can be exploited through the methods yii\redis\ActiveRecord::findOne() and yii\redis\ActiveRecord::findAll(). Attackers who can access these methods can manipulate data on the Redis server, potentially leading to unauthorized access, data corruption, or other malicious activities.
How To Fix
Minimum fixed version
2.0.8
This is the first release that contains the fix.
composer require yiisoft/yii2-redis:2.0.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading the yii2-redis package is not immediately feasible, a possible workaround is to restrict access to the vulnerable methods (yii\redis\ActiveRecord::findOne() and yii\redis\ActiveRecord::findAll()) by implementing custom access controls or by temporarily disabling the affected functionality. However, this workaround should be considered temporary, and upgrading to the latest secure version of the package is strongly recommended.
Conclusion
The yii2-redis package is vulnerable to potential remote code execution in the LUA context of the Redis server. This can be exploited through the methods yii\redis\ActiveRecord::findOne() and yii\redis\ActiveRecord::findAll(), allowing attackers to manipulate data on the Redis server. To mitigate this vulnerability, it is recommended to upgrade the package to version 2.0.8 or later. Alternatively, access to the vulnerable methods can be restricted or temporarily disabled. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for yiisoft/yii2-redis →
FAQ
The vulnerability allows attackers to execute arbitrary code in the LUA context of the Redis server. This can lead to unauthorized access, data manipulation, or other malicious activities.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. The playground allows you to analyze your composer.lock file and provides real-time alerts for open-source vulnerabilities.
At the time of this report, there are no known public exploits specifically targeting this vulnerability. However, it is important to address the vulnerability promptly to prevent potential exploitation.
While upgrading to the latest secure version of the yii2-redis package is the recommended solution, you can temporarily mitigate the vulnerability by implementing custom access controls or by disabling the affected functionality. However, these measures should be considered temporary, and upgrading the package should be prioritized.
You can find more information about the vulnerability in the GitHub Advisory Database (https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-4hx3-m8w5-g5qh/GHSA-4hx3-m8w5-g5qh.json). This includes the source of the vulnerability and the fixed version of the package.
Related vulnerabilities
Recent vulnerabilities recorded for yiisoft/yii2-redis.
