Reflected XSS Vulnerability in PHP5 on Alpine Linux: CVE-2018-5712
Summary
ALPINE-CVE-2018-5712: An issue was discovered in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1. Affects php5 versions < 5.6.36-r0. Fixed in 5.6.36-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP5 is a widely-used open-source scripting language designed for web development but also used as a general-purpose programming language. It allows developers to create dynamic web pages and applications. The vulnerability in question affects versions of PHP5 prior to 5.6.36-r0, exposing applications to reflected cross-site scripting (XSS) attacks through the PHAR 404 error page.
Vulnerability Detail
An issue was discovered in PHP before version 5.6.33, where the PHAR (PHP Archive) 404 error page is susceptible to reflected XSS. This vulnerability allows an attacker to craft a malicious request for a .phar file, which, if accessed by a user, could execute arbitrary scripts in the context of the user's session. The potential ramifications include unauthorized access to sensitive information and manipulation of user sessions.
How To Fix
Minimum fixed version
5.6.36-r0
This is the first release that contains the fix.
sudo apk add --upgrade php5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to .phar files or implement input validation to sanitize user inputs. This can help mitigate the risk of XSS attacks until the package is updated.
Conclusion
The CVE-2018-5712 vulnerability in PHP5 poses a significant risk due to its potential for reflected XSS attacks. It is crucial for users to update their PHP5 installations to the patched version 5.6.36-r0 to safeguard their applications. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for php5 →
FAQ
CVE-2018-5712 is a vulnerability in PHP5 that allows for reflected XSS attacks via the PHAR 404 error page.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
If exploited, this vulnerability can lead to unauthorized access to user sessions and sensitive data, potentially compromising the security of your application.
Yes, the patched version of PHP5 is 5.6.36-r0. Updating to this version will resolve the vulnerability.
Reflected XSS is a type of attack where malicious scripts are reflected off a web server, allowing attackers to execute scripts in the context of a user's session.
References
Related vulnerabilities
Recent vulnerabilities recorded for php5.
