CVE-2018-8074: Yii Framework Code Injection
Summary
CVE-2018-8074: Yii Framework Code Injection. Affects yiisoft/yii2-dev versions >= 2.0.0, < 2.0.15. Fixed in 2.0.15. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Yii Framework is a high-performance PHP framework used for developing web applications. It provides a set of tools and features to simplify the development process and enhance security. The framework is widely adopted and has a large community of developers contributing to its development and maintenance. However, Yii 2.x versions prior to 2.0.15 are vulnerable to code injection attacks when used in conjunction with the Elasticsearch extension.
Vulnerability Detail
The vulnerability, identified as CVE-2018-8074, allows remote attackers to inject unintended search conditions into the Yii Framework. This can be exploited by leveraging a variant of the CVE-2018-7269 attack in combination with the Elasticsearch extension. The injection of malicious code can lead to unauthorized access, data manipulation, or other malicious activities. The severity of this vulnerability is rated as HIGH with a CVSS score of 8.1.
How To Fix
Minimum fixed version
2.0.15
This is the first release that contains the fix.
composer require yiisoft/yii2-dev:2.0.15Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable or remove the Elasticsearch extension from the Yii Framework. This can be done by modifying the application configuration file and commenting out or removing the relevant lines of code that enable the Elasticsearch extension. However, this workaround may impact the functionality of the application that relies on Elasticsearch features.
Conclusion
The Yii Framework is vulnerable to code injection attacks when used in conjunction with the Elasticsearch extension. Upgrading to Yii Framework version 2.0.15 or later is recommended to mitigate this vulnerability. If immediate upgrade is not possible, temporarily disabling or removing the Elasticsearch extension can serve as a workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for yiisoft/yii2-dev →
FAQ
The vulnerability allows remote attackers to inject malicious code into the Yii Framework, potentially leading to unauthorized access, data manipulation, or other malicious activities.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your composer.lock file to the playground, and it will analyze the dependencies and alert you if any vulnerabilities are found.
Yes, upgrading Yii Framework to version 2.0.15 or later will fix this vulnerability. It is recommended to update your application to the latest version of Yii Framework and ensure that the Elasticsearch extension is also up to date.
Yes, you can temporarily disable or remove the Elasticsearch extension from the Yii Framework. However, this may impact the functionality of your application that relies on Elasticsearch features.
You can find more information about this vulnerability in the Yii Framework advisory database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-m2p5-fwp2-qcw2/GHSA-m2p5-fwp2-qcw2.json
Related vulnerabilities
Recent vulnerabilities recorded for yiisoft/yii2-dev.
