CVE-2024-44902: ThinkPHP deserialization vulnerability in topthink/framework
Summary
CVE-2024-44902: ThinkPHP deserialization vulnerability. Affects topthink/framework versions >= 6.1.3, <= 8.0.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
topthink/framework is a package available on Packagist that is used in the ThinkPHP framework. ThinkPHP is a popular PHP framework used for developing web applications. The topthink/framework package provides essential functionalities and components for the ThinkPHP framework.
Vulnerability Detail
A deserialization vulnerability has been discovered in ThinkPHP versions 6.1.3 to 8.0.4. This vulnerability allows attackers to execute arbitrary code on the affected system. The vulnerability originates from improper handling of deserialized data, which can be exploited to execute malicious code. Attackers can potentially gain unauthorized access, manipulate data, or perform other malicious activities on the affected system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the topthink/framework package to a patched version to address the issue.
Conclusion
The deserialization vulnerability in ThinkPHP versions 6.1.3 to 8.0.4 can lead to arbitrary code execution. It is crucial to update the topthink/framework package to a patched version (8.0.5 or above) to mitigate the vulnerability. No workarounds are available for this issue.
See every vulnerability recorded for topthink/framework →
FAQ
This vulnerability allows attackers to execute arbitrary code on the affected system, potentially leading to unauthorized access, data manipulation, or other malicious activities.
ThinkPHP versions 6.1.3 to 8.0.4 are affected by this vulnerability.
Yes, the maintainers of ThinkPHP have released a patch for this vulnerability in versions 8.0.5 and above. It is recommended to update to the latest version of the topthink/framework package.
No, there are no known workarounds for this vulnerability. Updating the topthink/framework package to a patched version is the recommended solution.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software using just the composer.lock file.
Related vulnerabilities
Recent vulnerabilities recorded for topthink/framework.
