CVE-2023-46240: CodeIgniter4 Framework Information Disclosure Vulnerability
Summary
CVE-2023-46240: Impact If an error or exception occurs in CodeIgniter4 v4.4.2 and earlier, a detailed error report is displayed even if in the production environment. Affects codeigniter4/framework versions < 4.4.3. Fixed in 4.4.3. How to fix ↓
Also tracked for
- codeigniter · Bitnami
The same CVE-2023-46240 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CodeIgniter4 is a popular PHP framework used for developing web applications. It provides a lightweight and efficient way to build robust and secure applications. The framework follows the MVC (Model-View-Controller) architectural pattern and offers various features such as routing, database abstraction, and form validation. However, CodeIgniter4 versions up to 4.4.2 are vulnerable to an information disclosure issue.
Vulnerability Detail
The vulnerability in CodeIgniter4 allows for the disclosure of sensitive information when a detailed error report is displayed in the production environment. When an error or exception occurs, even in the production mode, CodeIgniter4 displays a detailed error report that may contain confidential information. This can lead to the exposure of sensitive data, potentially compromising the security and privacy of the application and its users.
How To Fix
Minimum fixed version
4.4.3
This is the first release that contains the fix.
composer require codeigniter4/framework:4.4.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented. In the app/Config/Boot/production.php file, replace the line ini_set('display_errors', '0') with ini_set('display_errors', 'Off'). This will disable the display of detailed error reports in the production environment, mitigating the risk of information disclosure.
Conclusion
The CodeIgniter4 framework versions up to 4.4.2 are vulnerable to an information disclosure issue that can expose sensitive information in the production environment. To mitigate this risk, it is recommended to upgrade to version 4.4.3 or later. Alternatively, a temporary workaround can be applied by modifying the app/Config/Boot/production.php file. For more information or assistance, you can reach out to the CodeIgniter4 team through the provided channels.
See every vulnerability recorded for codeigniter4/framework →
FAQ
The vulnerability allows for the disclosure of sensitive information, which can include database credentials, API keys, and other confidential data. This can lead to unauthorized access, data breaches, and other security incidents.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your composer.lock file, and Vulert will analyze it for any known vulnerabilities, including this CodeIgniter4 information disclosure issue.
No, only CodeIgniter4 versions up to 4.4.2 are affected by this vulnerability. Upgrading to version 4.4.3 or later will address the issue.
Yes, you can apply the provided workaround by modifying the app/Config/Boot/production.php file. However, upgrading to the latest version is the recommended solution as it includes a proper fix for the vulnerability.
If you have any further questions or concerns about this vulnerability, you can open an issue in the CodeIgniter4 GitHub repository at https://github.com/codeigniter4/CodeIgniter4/issues. Alternatively, you can also email the CodeIgniter4 team at SECURITY.md.
References
Related vulnerabilities
Recent vulnerabilities recorded for codeigniter4/framework.
