CVE-2022-24711: CodeIgniter4 Improper Input Validation Vulnerability
Summary
CVE-2022-24711: CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. Affects codeigniter versions >= 4.0.0, < 4.1.9. Fixed in 4.1.9. How to fix ↓
Also tracked for
- codeigniter4/framework · Packagist
The same CVE-2022-24711 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CodeIgniter4 is a PHP full-stack web framework, known for its simplicity and flexibility. It provides developers with a set of tools and libraries to build robust web applications. However, prior to version 4.1.9, CodeIgniter4 is vulnerable to an improper input validation issue. This vulnerability allows attackers to execute CLI routes via an HTTP request, potentially leading to unauthorized access and remote code execution. It is crucial for CodeIgniter4 users to update to version 4.1.9 or apply the provided patch to mitigate this vulnerability.
Vulnerability Detail
The vulnerability in CodeIgniter4 stems from improper input validation. Attackers can exploit this flaw by sending specially crafted HTTP requests to execute CLI routes. This can result in various security risks, including unauthorized access to sensitive information, remote code execution, and potential compromise of the entire web application. The severity of this vulnerability is rated as critical, with a CVSSv3 score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). It is crucial for CodeIgniter4 users to take immediate action to address this vulnerability.
How To Fix
Minimum fixed version
4.1.9
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The improper input validation vulnerability in CodeIgniter4 (CVE-2022-24711) poses a significant risk to web applications built using this framework. It is crucial for CodeIgniter4 users to update to version 4.1.9 or apply the provided patch to mitigate this vulnerability. Failure to address this issue could result in unauthorized access, remote code execution, and potential compromise of the entire application. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for codeigniter →
FAQ
To check the version of CodeIgniter4, navigate to the root directory of your application and open the 'composer.json' file. Look for the 'codeigniter4/framework' package and check the version specified.
Yes, it is possible to apply the patch manually if you are unable to update to version 4.1.9 immediately. The patch can be found in the official CodeIgniter repository on GitHub. Follow the instructions provided in the patch file to apply the necessary changes to your CodeIgniter4 installation.
Currently, there are no known workarounds for this vulnerability. It is highly recommended to update to version 4.1.9 or apply the provided patch as soon as possible to mitigate the risk.
The improper input validation vulnerability in CodeIgniter4 can lead to various security risks, including unauthorized access to sensitive information, remote code execution, and potential compromise of the entire web application. It is crucial to address this vulnerability promptly to prevent any potential harm.
For more information about this vulnerability, you can refer to the official CodeIgniter security advisory or the CVE entry (CVE-2022-24711). These sources provide detailed information about the vulnerability, its impact, and the necessary steps to mitigate it.
References
Related vulnerabilities
Recent vulnerabilities recorded for codeigniter.
