XSS Vulnerability in PHP5 and Apache2 Handler - CVE-2018-17082
Summary
ALPINE-CVE-2018-17082: The Apache2 component in PHP before 5.6.38, 7.0.x before 7.0.32, 7.1.x before 7.1.22, and 7.2.x before 7.2.10 allows XSS via the body of a "Transfer-Encoding: chunked" request, because the bucket brigade is mishandled in... Affects php5 versions < 5.6.38-r0. Fixed in 5.6.38-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a widely-used open-source scripting language designed for web development but also used as a general-purpose programming language. The Apache2 component in PHP allows for the integration of PHP scripts with the Apache web server. This integration is crucial for dynamic web applications. However, certain versions of PHP have been found to be vulnerable to an XSS attack due to mishandling of the 'Transfer-Encoding: chunked' requests.
Vulnerability Detail
The vulnerability identified as CVE-2018-17082 affects PHP versions prior to 5.6.38, 7.0.x before 7.0.32, 7.1.x before 7.1.22, and 7.2.x before 7.2.10. It allows attackers to execute cross-site scripting (XSS) attacks through the body of a 'Transfer-Encoding: chunked' request. This occurs because the bucket brigade is mishandled in the php_handler function located in sapi/apache2handler/sapi_apache2.c. If exploited, this vulnerability can lead to unauthorized access to sensitive information and potentially compromise the integrity of web applications.
How To Fix
Minimum fixed version
5.6.38-r0
This is the first release that contains the fix.
sudo apk add --upgrade php5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the 'Transfer-Encoding: chunked' feature in your web server configuration, though this may not be feasible for all applications. Alternatively, consider implementing input validation and sanitization to mitigate the risk of XSS attacks.
Conclusion
CVE-2018-17082 is a significant vulnerability affecting multiple versions of PHP, allowing for XSS attacks through mishandled requests. It is crucial to update to the patched version to safeguard web applications from potential exploitation. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for php5 →
FAQ
CVE-2018-17082 is a vulnerability in certain versions of PHP that allows for cross-site scripting (XSS) attacks through mishandled 'Transfer-Encoding: chunked' requests.
Affected versions include PHP before 5.6.38, 7.0.x before 7.0.32, 7.1.x before 7.1.22, and 7.2.x before 7.2.10.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2018-17082 is 6.1, indicating a medium severity level.
If immediate updates are not possible, consider implementing input validation and sanitization as a temporary measure to reduce the risk of XSS attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for php5.
