CVE-2020-15148: Unsafe deserialization in Yii 2
Summary
CVE-2020-15148: Unsafe deserialization in Yii 2. Affects yiisoft/yii2 versions < 2.0.38. Fixed in 2.0.38. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Yii 2 is a popular PHP framework used for developing web applications. It provides a set of libraries and tools that enable developers to build robust and secure applications. However, Yii 2 is vulnerable to an unsafe deserialization vulnerability, which can lead to remote code execution if the application calls unserialize() on user input containing a specially crafted string.
Vulnerability Detail
The unsafe deserialization vulnerability in Yii 2 allows an attacker to execute arbitrary code on the server by manipulating the serialized data passed to the unserialize() function. This can be exploited by sending a malicious request to the application, causing it to deserialize the attacker's payload and execute it. The impact of this vulnerability is severe, as it allows an attacker to gain full control over the affected system.
How To Fix
Minimum fixed version
2.0.38
This is the first release that contains the fix.
composer require yiisoft/yii2:2.0.38Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the patched version is not immediately possible, a temporary workaround can be implemented by adding the following code to the BatchQueryResult.php file:
public function __sleep()
{
throw new \BadMethodCallException('Cannot serialize '.__CLASS__);
}
public function __wakeup()
{
throw new \BadMethodCallException('Cannot unserialize '.__CLASS__);
}
Conclusion
The unsafe deserialization vulnerability in Yii 2 can lead to remote code execution and full compromise of the affected system. It is crucial to upgrade to version 2.0.38 or later to mitigate the risk. If immediate upgrade is not possible, applying the provided workaround can help protect the application. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for yiisoft/yii2 →
FAQ
The impact of this vulnerability is severe, as it allows an attacker to execute arbitrary code on the server, potentially leading to a complete compromise of the affected system.
To fix this vulnerability, you should upgrade your Yii 2 installation to version 2.0.38 or later. Alternatively, you can apply the provided workaround until you are able to upgrade.
Yes, this vulnerability can be exploited remotely by sending a specially crafted request to the affected application.
There are no known instances of this vulnerability being exploited in the wild at the time of this advisory.
For more information about this vulnerability, you can contact the Yii Framework security team through their security form: https://www.yiiframework.com/security
References
Related vulnerabilities
Recent vulnerabilities recorded for yiisoft/yii2.
