CVE-2024-29904: CodeIgniter4 DoS Vulnerability
Summary
CVE-2024-29904: CodeIgniter4 DoS Vulnerability. Affects codeigniter4/framework versions < 4.4.7. Fixed in 4.4.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CodeIgniter4 is a popular PHP framework used for developing web applications. It provides a set of libraries and tools that simplify the development process. The Language class in CodeIgniter4 is responsible for handling localization and language-related tasks. It allows developers to load language files and retrieve translated strings. However, a vulnerability has been discovered in the Language class that can be exploited by an attacker to launch a Denial of Service (DoS) attack. By passing invalid values to the lang() function or Language class, an attacker can cause the server to consume excessive memory, leading to a DoS condition.
Vulnerability Detail
The vulnerability in the Language class of CodeIgniter4 allows an attacker to trigger a DoS attack by exploiting a flaw in the handling of invalid values. By passing specially crafted input to the lang() function or Language class, an attacker can cause the server to allocate and consume a large amount of memory. This can lead to the exhaustion of server resources, resulting in a DoS condition. The impact of this vulnerability can be severe, as it can disrupt the availability of the affected web application and potentially affect other services running on the same server.
How To Fix
Minimum fixed version
4.4.7
This is the first release that contains the fix.
composer require codeigniter4/framework:4.4.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
In addition to upgrading, there are two workarounds that can be implemented to mitigate the risk of this vulnerability:
-
Disabling Auto Routing: By disabling the Auto Routing feature in the framework, a known attack vector can be prevented. This can be achieved by modifying the application configuration file.
-
Validating Input: Developers should ensure that only valid values are passed to the
lang()function orLanguageclass. Input validation can help prevent the exploitation of this vulnerability.
Conclusion
The CodeIgniter4 DoS vulnerability in the Language class poses a significant risk to web applications built using this framework. It is crucial to upgrade to version 4.4.7 or later and apply the necessary patches to mitigate the vulnerability. Additionally, implementing the recommended workarounds, such as disabling Auto Routing and validating input, can further reduce the risk of exploitation. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for codeigniter4/framework →
FAQ
CodeIgniter4 is a PHP framework used for developing web applications. It provides a set of libraries and tools that simplify the development process.
The Language class in CodeIgniter4 is responsible for handling localization and language-related tasks. It allows developers to load language files and retrieve translated strings.
A DoS (Denial of Service) attack is a type of cyber attack where an attacker attempts to disrupt the availability of a service or system by overwhelming it with a large volume of requests or by consuming excessive resources.
This vulnerability can be exploited by passing invalid values to the lang() function or Language class in CodeIgniter4. By doing so, an attacker can cause the server to allocate and consume a large amount of memory, leading to a DoS condition.
The impact of this vulnerability can be severe. It can disrupt the availability of the affected web application and potentially affect other services running on the same server.
References
Related vulnerabilities
Recent vulnerabilities recorded for codeigniter4/framework.
