CVE-2020-4043: Phar unserialization vulnerability in phpMussel
Summary
CVE-2020-4043: Phar unserialization vulnerability in phpMussel. Affects phpmussel/phpmussel versions >= 1.0.0, < 1.6.0. Fixed in 1.6.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMussel is an open-source package available on Packagist that provides a PHP-based anti-virus scanner for detecting and removing malicious code from files. It is commonly used to enhance the security of web applications by scanning uploaded files for potential threats. However, versions between v1.0.0 and v1.6.0 of phpMussel are vulnerable to a Phar unserialization vulnerability.
Vulnerability Detail
The vulnerability in phpMussel arises from a Phar unserialization issue. This vulnerability allows an attacker to execute arbitrary code during the unserialization process, potentially leading to remote code execution. Any user of phpMussel with a version between v1.0.0 and v1.6.0 is impacted by this vulnerability. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.7.
How To Fix
Minimum fixed version
1.6.0
This is the first release that contains the fix.
composer require phpmussel/phpmussel:1.6.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately feasible, users can disable archive checking in the package's configuration by setting the 'check_archives' parameter to 'false'. This will prevent the execution of the affected parts of the codebase and mitigate the vulnerability.
Conclusion
In conclusion, the Phar unserialization vulnerability in phpMussel poses a significant risk to users of versions between v1.0.0 and v1.6.0. It is crucial to upgrade to at least v1.6.0 or the latest available version to ensure the security of the application. If immediate upgrading is not possible, disabling archive checking can provide a temporary workaround. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpmussel/phpmussel →
FAQ
Anyone using phpMussel with a version between v1.0.0 and v1.6.0 is affected by this vulnerability.
The vulnerability allows an attacker to execute arbitrary code, potentially leading to remote code execution.
Yes, the vulnerability has been patched in phpMussel v1.6.0 and later versions.
Yes, users can disable archive checking in the package's configuration to mitigate the vulnerability.
More information about this vulnerability can be found in the SECURITY.md file of the phpMussel repository and in issue #167 on GitHub.
