Reflected XSS Vulnerability in PHP5 - PHAR Error Pages
Summary
ALPINE-CVE-2018-10547: An issue was discovered in ext/phar/phar_object.c in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. Affects php5 versions < 5.6.36-r0. Fixed in 5.6.36-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP5 is a widely-used open-source scripting language designed for web development but also used as a general-purpose programming language. It is known for its flexibility, ease of use, and extensive community support. However, certain versions of PHP5 are vulnerable to a reflected cross-site scripting (XSS) attack, particularly in the handling of PHAR file error pages.
Vulnerability Detail
An issue was discovered in ext/phar/phar_object.c in PHP before version 5.6.36. This vulnerability allows for reflected XSS on the PHAR 403 and 404 error pages via request data when a .phar file is requested. The vulnerability arises from an incomplete fix for CVE-2018-5712, which could lead to malicious scripts being executed in the context of the user's browser, potentially compromising sensitive information.
How To Fix
Minimum fixed version
5.6.36-r0
This is the first release that contains the fix.
sudo apk add --upgrade php5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the handling of PHAR files or implement strict input validation to prevent the execution of malicious scripts. However, this is not a permanent solution and updating the package is highly recommended.
Conclusion
The reflected XSS vulnerability in PHP5 related to PHAR error pages poses a significant risk to applications using affected versions. It is crucial to update to the patched version to mitigate potential attacks. Regular monitoring and vulnerability management practices, such as using tools like Vulert, can help maintain the security of your applications.
See every vulnerability recorded for php5 →
FAQ
PHAR (PHP Archive) files are used to package PHP applications and libraries into a single file for easier distribution and deployment.
If your application uses PHP versions affected by this vulnerability, it may be susceptible to XSS attacks, allowing attackers to execute scripts in the context of your users' browsers.
The CVSS score for this vulnerability is 6.1, indicating a medium severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json. You can check your application for vulnerabilities without any signup at the Vulert playground.
While this vulnerability primarily poses a risk of XSS attacks, it can lead to data exposure or loss if sensitive information is accessed through the compromised session.
References
Related vulnerabilities
Recent vulnerabilities recorded for php5.
