CVE-2023-32692: CodeIgniter Arbitrary Code Execution
Summary
CVE-2023-32692: CodeIgniter is a PHP full-stack web framework. Affects codeigniter versions < 4.3.5. Fixed in 4.3.5. How to fix ↓
Also tracked for
- codeigniter4/framework · Packagist
The same CVE-2023-32692 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CodeIgniter is a PHP full-stack web framework known for its simplicity and flexibility. It provides a set of libraries for common tasks, making it easier to develop web applications. However, a critical vulnerability has been discovered in CodeIgniter that allows attackers to execute arbitrary code when using Validation Placeholders. This vulnerability affects the Validation library, as well as validation methods in the controller and in-model validation. It has been patched in version 4.3.5.
Vulnerability Detail
The vulnerability arises from the improper handling of Validation Placeholders in CodeIgniter. Attackers can exploit this issue to execute arbitrary code, potentially leading to remote code execution, data breaches, or other malicious activities. The vulnerability has a CVSSv3 score of 9.8 (Critical) and can be exploited without any authentication or user interaction.
How To Fix
Minimum fixed version
4.3.5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the use of Validation Placeholders in your CodeIgniter application. This can be achieved by modifying the code that utilizes the Validation library and removing any placeholders. However, this workaround may impact the functionality of your application, so it is advised to apply the official patch as soon as possible.
Conclusion
CodeIgniter is vulnerable to an arbitrary code execution vulnerability when using Validation Placeholders. It is crucial to update to version 4.3.5 or later to mitigate this issue. If you have any further questions or need assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for codeigniter →
FAQ
CodeIgniter is a PHP full-stack web framework known for its simplicity and flexibility. It provides a set of libraries for common tasks, making it easier to develop web applications.
This vulnerability allows attackers to execute arbitrary code, potentially leading to remote code execution, data breaches, or other malicious activities.
To fix this vulnerability, update CodeIgniter to version 4.3.5 or later. This version includes the necessary patches to mitigate the issue.
As a temporary workaround, you can disable the use of Validation Placeholders in your CodeIgniter application. However, it is recommended to apply the official patch as soon as possible.
For more information about this vulnerability, you can refer to the CVE identifier (CVE-2023-32692) or the CodeIgniter documentation.
References
Related vulnerabilities
Recent vulnerabilities recorded for codeigniter.
