UNKNOWN WRITE Vulnerability in php_strip_url_passwd
Summary
OSV-2023-1167: UNKNOWN WRITE in php_strip_url_passwd. Affects php across 2 version ranges.
< daa38dd63e6837ec7e3ecdecf7e7be7b13628f16
>= df286a1b9819fd2a4f3ec57d722f687b4f5eaa6f, < d8e866da04ec5883500332b3d31d5a684188463e
Fixed in d8e866da04ec5883500332b3d31d5a684188463e. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The php package is a popular open-source scripting language widely used for web development. It provides a powerful and flexible platform for creating dynamic websites and applications. This vulnerability affects the php package and specifically the php_strip_url_passwd function. This function is responsible for removing the password component from a URL. However, due to a flaw, an unknown write vulnerability exists in this function, which can lead to unexpected behavior and potential security risks.
Vulnerability Detail
The UNKNOWN WRITE vulnerability in php_strip_url_passwd allows an attacker to perform an unauthorized write operation, potentially leading to memory corruption or other security issues. This vulnerability can be triggered by passing specially crafted input to the php_strip_url_passwd function. Successful exploitation of this vulnerability could result in remote code execution or information disclosure. The vulnerability was discovered through the OSS-Fuzz project and has been assigned a severity rating of HIGH.
How To Fix
Minimum fixed version
d8e866da04ec5883500332b3d31d5a684188463e
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
At present, no known workarounds are available for this vulnerability. It is recommended to apply the official patch or update to a fixed version of the php package as soon as possible.
Conclusion
The UNKNOWN WRITE vulnerability in php_strip_url_passwd poses a significant risk to systems using the php package. It is crucial to update to a fixed version or apply the official patch to mitigate the potential security issues. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for php →
FAQ
This vulnerability can allow an attacker to execute arbitrary code or disclose sensitive information, potentially leading to a compromise of the affected system.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and Vulert will analyze it for any open-source vulnerabilities, including this one.
At the time of this report, there is no known public exploit for this vulnerability. However, it is important to apply the necessary updates or patches to mitigate the risk.
Yes, this vulnerability can be exploited remotely. An attacker can send specially crafted input to the vulnerable php_strip_url_passwd function, potentially leading to remote code execution or information disclosure.
Yes, the vulnerability has been fixed in the php package. Users are advised to update to a version that includes the patch or commit df286a1b9819fd2a4f3ec57d722f687b4f5eaa6f or a later version.
References
Related vulnerabilities
Recent vulnerabilities recorded for php.
