CVE-2022-41922: Remote Code Execution in yiisoft/yii
Summary
CVE-2022-41922: Prevent RCE when deserializing untrusted user input. Affects yiisoft/yii versions < 1.1.27. Fixed in 1.1.27. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The yiisoft/yii package is a popular PHP framework that provides a set of tools and components for building web applications. It offers features such as MVC architecture, database abstraction, caching, and security mechanisms. However, versions of yiisoft/yii prior to 1.1.27 are vulnerable to Remote Code Execution (RCE) when the application calls unserialize() on untrusted user input.
Vulnerability Detail
The vulnerability arises from the insecure usage of unserialize() function on arbitrary user input. This can lead to the deserialization of malicious objects, allowing an attacker to execute arbitrary code on the server. The impact of this vulnerability is high, as it enables remote attackers to gain unauthorized access, modify data, or disrupt the application's functionality. It is important to note that this vulnerability falls under the category of PHP Object Injection, which is a well-known security issue.
How To Fix
Minimum fixed version
1.1.27
This is the first release that contains the fix.
composer require yiisoft/yii:1.1.27Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading yiisoft/yii is not immediately feasible, a temporary workaround is to avoid calling unserialize() on untrusted user input. Instead, implement strict input validation and filtering to prevent the injection of malicious objects. Additionally, consider implementing a web application firewall (WAF) to detect and block potential attacks.
Conclusion
The vulnerability in yiisoft/yii allows remote code execution, posing a significant risk to the security and integrity of web applications. It is crucial to upgrade to version 1.1.27 or higher to mitigate this vulnerability. Implementing strict input validation and filtering, as well as using a web application firewall, can provide additional protection. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for yiisoft/yii →
FAQ
The vulnerability allows remote attackers to execute arbitrary code on the server, potentially leading to unauthorized access, data manipulation, or disruption of the application's functionality.
To fix this vulnerability, upgrade yiisoft/yii to version 1.1.27 or higher. This version includes a patch that addresses the insecure usage of unserialize().
If immediate upgrade is not possible, implement strict input validation and filtering to prevent the injection of malicious objects. Consider using a web application firewall (WAF) to detect and block potential attacks.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability. However, it is crucial to apply the recommended patch or upgrade to protect against potential attacks.
You can find more information about PHP Object Injection and its impact on web applications in the OWASP documentation: https://owasp.org/www-community/vulnerabilities/PHP_Object_Injection
References
Related vulnerabilities
Recent vulnerabilities recorded for yiisoft/yii.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
