CVE-2024-32877: Reflected Cross-site Scripting in yiisoft/yii2 Debug mode
Summary
CVE-2024-32877: Reflected Cross-site Scripting in yiisoft/yii2 Debug mode. Affects yiisoft/yii2 versions >= 2.0.43, < 2.0.49.4. Fixed in 2.0.49.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Yii2 is a popular PHP framework used for developing web applications. It provides a wide range of features and functionalities to simplify the development process. However, the framework is vulnerable to a reflected cross-site scripting (XSS) attack when it is in debug mode. This vulnerability affects the latest version of Yii2 (2.0.49.3).
Vulnerability Detail
The vulnerability occurs when the framework is in debug mode and an exception is induced in the application, resulting in a stack trace page being displayed. The issue lies in the mechanism for displaying function argument values in the stack trace. If an argument's value exceeds 32 characters, it is truncated and displayed with an added "...". However, an attacker can exploit this by injecting their own attributes, including malicious JavaScript code, into the span tag using a double quote ("). This allows the attacker to execute arbitrary JavaScript code in the victim's site, potentially leading to cookie theft, content substitution, or complete takeover of user accounts.
How To Fix
Minimum fixed version
2.0.49.4
This is the first release that contains the fix.
composer require yiisoft/yii2:2.0.49.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the suggested fix as soon as possible.
Conclusion
In conclusion, the Yii2 framework is vulnerable to a reflected cross-site scripting (XSS) attack when it is in debug mode. This can allow an attacker to execute arbitrary JavaScript code in the victim's site, potentially leading to serious security breaches. It is highly recommended to apply the suggested fix as soon as possible to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for yiisoft/yii2 →
FAQ
This vulnerability allows an attacker to execute arbitrary JavaScript code in the security context of the victim's site. This can lead to the theft of cookies, content substitution, or complete takeover of user accounts.
The vulnerability affects the latest version of Yii2 (2.0.49.3).
No, there is no known workaround for this vulnerability. It is recommended to apply the suggested fix as soon as possible.
You can use Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. It analyzes your composer.lock file and provides real-time alerts for open-source vulnerabilities.
For further assistance or support on vulnerability remediation, you can contact info@devnack.com.
References
Related vulnerabilities
Recent vulnerabilities recorded for yiisoft/yii2.
