CVE-2023-47130: Remote Code Execution in yiisoft/yii
Summary
CVE-2023-47130: yiisoft/yii deserializing untrusted user input can lead to remote code execution. Affects yiisoft/yii versions < 1.1.29. Fixed in 1.1.29. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
yiisoft/yii is a popular PHP framework that provides a set of tools and components for building web applications. It offers features such as MVC architecture, database abstraction, and security mechanisms. However, versions of yiisoft/yii prior to 1.1.29 are vulnerable to a Remote Code Execution (RCE) vulnerability when the application calls the unserialize() function on untrusted user input. This vulnerability can allow an attacker to execute arbitrary code on the affected system.
Vulnerability Detail
The vulnerability arises from the insecure deserialization of user input. When the unserialize() function is used on untrusted data, it can lead to the execution of malicious code. This can result in various consequences, including unauthorized access, data manipulation, and complete compromise of the affected system. The vulnerability has a CVSS score of 8.1, indicating a high severity level.
How To Fix
Minimum fixed version
1.1.29
This is the first release that contains the fix.
composer require yiisoft/yii:1.1.29Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to avoid using the unserialize() function on untrusted user input. Instead, it is recommended to implement strict input validation and use alternative methods for data deserialization.
Conclusion
The vulnerability in yiisoft/yii allows remote code execution through insecure deserialization. To mitigate this risk, it is crucial to upgrade to version 1.1.29 or higher. If immediate upgrading is not possible, strict input validation and alternative deserialization methods should be implemented. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for yiisoft/yii →
FAQ
yiisoft/yii is a PHP framework used for developing web applications. It provides a range of features and tools to simplify the development process.
The vulnerability allows remote code execution, which can lead to unauthorized access, data manipulation, and complete compromise of the affected system.
To fix this vulnerability, upgrade yiisoft/yii to version 1.1.29 or higher. This version includes a patch that addresses the insecure deserialization issue.
If immediate upgrading is not possible, it is recommended to avoid using the unserialize() function on untrusted user input. Implement strict input validation and consider alternative methods for data deserialization.
You can find more information about this vulnerability in the provided links: https://github.com/yiisoft/yii/commit/37142be4dc5831114a375392e86d6450d4951c06 and https://owasp.org/www-community/vulnerabilities/PHP_Object_Injection
References
Related vulnerabilities
Recent vulnerabilities recorded for yiisoft/yii.
