CVE-2022-47945: ThinkPHP Framework Remote Code Execution
Summary
CVE-2022-47945: ThinkPHP Framework vulnerable to remote code execution. Affects topthink/framework versions < 6.0.14. Fixed in 6.0.14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ThinkPHP Framework is a popular PHP framework used for developing web applications. It provides a range of features and functionalities to simplify the development process. However, versions before 6.0.14 are vulnerable to remote code execution. This vulnerability arises when the language pack feature is enabled with the lang_switch_on=true configuration. An attacker can exploit this vulnerability to execute arbitrary operating system commands by manipulating the lang parameter. The vulnerability allows for local file inclusion, enabling the attacker to include malicious files such as pearcmd.php.
Vulnerability Detail
The ThinkPHP Framework vulnerability (CVE-2022-47945) allows an unauthenticated and remote attacker to execute arbitrary operating system commands. By leveraging the language pack feature and manipulating the lang parameter, the attacker can include malicious files and execute arbitrary code. This can lead to a complete compromise of the affected system, enabling the attacker to perform unauthorized actions, access sensitive information, or disrupt the system's functionality.
How To Fix
Minimum fixed version
6.0.14
This is the first release that contains the fix.
composer require topthink/framework:6.0.14Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can disable the language pack feature by setting lang_switch_on=false in the configuration file. This will prevent the exploitation of the vulnerability. However, it is strongly advised to upgrade to the latest version of ThinkPHP Framework to fully address the vulnerability.
Conclusion
The ThinkPHP Framework vulnerability (CVE-2022-47945) exposes applications to remote code execution. To mitigate this vulnerability, it is crucial to upgrade to ThinkPHP Framework version 6.0.14 or later. Additionally, disabling the language pack feature (lang_switch_on=false) can provide temporary protection. It is recommended to follow best practices for secure coding and regularly update dependencies to prevent potential security risks. For further assistance and support in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for topthink/framework →
FAQ
The vulnerability allows an attacker to execute arbitrary operating system commands, potentially leading to a complete compromise of the affected system. This can result in unauthorized access, data breaches, or disruption of the system's functionality.
No, authentication is not required. The vulnerability can be exploited by an unauthenticated and remote attacker.
There are no known instances of this vulnerability being exploited in the wild at the time of this report. However, it is important to apply the necessary fixes and security measures to prevent potential exploitation.
While disabling the language pack feature (lang_switch_on=false) can mitigate the vulnerability temporarily, it is strongly recommended to upgrade to the latest version of ThinkPHP Framework to fully address the issue.
For more information about this vulnerability, you can refer to the official GitHub advisory: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-p4qr-vq2g-22wp/GHSA-p4qr-vq2g-22wp.json
Related vulnerabilities
Recent vulnerabilities recorded for topthink/framework.
