CVE-2019-11830: Typo3/phar-stream-wrapper Unsafe Deserialization Vulnerability
Summary
CVE-2019-11830: PharStreamWrapper for Typo3 unsafe deserialization vulnerability. Affects typo3/phar-stream-wrapper across 2 version ranges.
>= 2.0.0, < 2.1.1
>= 3.0.0, < 3.1.1
Fixed in 2.1.1 or 3.1.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Typo3/phar-stream-wrapper is a package available on Packagist that provides a stream wrapper for PHP Archive (PHAR) files. It allows developers to interact with PHAR files as if they were regular files. This vulnerability affects versions 2.x before 2.1.1 and 3.x before 3.1.1 of the package. The package mishandles Phar stub parsing, which can be exploited by attackers to bypass a deserialization protection mechanism.
Vulnerability Detail
The vulnerability in Typo3/phar-stream-wrapper arises from a flaw in the PharMetaDataInterceptor component. This flaw allows attackers to manipulate the Phar stub parsing process, leading to the bypassing of the deserialization protection mechanism. By exploiting this vulnerability, an attacker can execute arbitrary code within the context of the application, potentially leading to remote code execution or other malicious activities.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.0.0, < 2.1.12.1.1composer require typo3/phar-stream-wrapper:2.1.1 -
>= 3.0.0, < 3.1.13.1.1composer require typo3/phar-stream-wrapper:3.1.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the Typo3/phar-stream-wrapper package to the fixed versions mentioned above.
Conclusion
The Typo3/phar-stream-wrapper package is vulnerable to an unsafe deserialization issue that can be exploited by attackers to execute arbitrary code. To mitigate this vulnerability, it is crucial to update the package to the fixed versions mentioned above. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for typo3/phar-stream-wrapper →
FAQ
Typo3/phar-stream-wrapper is a package that provides a stream wrapper for PHP Archive (PHAR) files. It allows developers to interact with PHAR files as if they were regular files.
Versions 2.x before 2.1.1 and 3.x before 3.1.1 of Typo3/phar-stream-wrapper are affected by this vulnerability.
This vulnerability allows attackers to bypass a deserialization protection mechanism, potentially leading to remote code execution or other malicious activities.
No, there is no known workaround for this vulnerability. It is crucial to update the Typo3/phar-stream-wrapper package to the fixed versions.
To fix this vulnerability, update the Typo3/phar-stream-wrapper package to version 2.1.1 or higher for versions 2.x, and version 3.1.1 or higher for versions 3.x.
Related vulnerabilities
Recent vulnerabilities recorded for typo3/phar-stream-wrapper.
