PHP Object Injection Vulnerability in contao/core
Summary
GHSA-wq43-8r5p-w3mc: contao/core PHP object injection vulnerability allows for arbitrary code execution. Affects contao/core across 2 version ranges.
>= 2.0.0, < 2.11.14
>= 3.0.0, < 3.2.5
Fixed in 2.11.14 or 3.2.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
contao/core is a PHP package that provides a content management system (CMS) for building websites. It offers various features such as user management, page creation, and template customization. However, a vulnerability has been discovered in contao/core that allows for PHP object injection, potentially leading to arbitrary code execution.
Vulnerability Detail
The vulnerability in contao/core arises from untrusted data being passed to the deserialize() function. This can allow an attacker to inject malicious PHP objects into the application, which may result in arbitrary code execution. If successfully exploited, this vulnerability could lead to unauthorized access, data manipulation, or even complete compromise of the affected system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.0.0, < 2.11.142.11.14composer require contao/core:2.11.14 -
>= 3.0.0, < 3.2.53.2.5composer require contao/core:3.2.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, it is advised to validate and sanitize any user-supplied data before passing it to the deserialize() function. This can help mitigate the risk of object injection. Here is an example of how to sanitize user input in PHP:
$input = $_POST['user_input'];
$sanitized_input = filter_var($input, FILTER_SANITIZE_STRING);
// Use the sanitized input in the application
By applying input validation and sanitization, the likelihood of successful exploitation can be reduced.
Conclusion
In conclusion, contao/core is vulnerable to a PHP object injection vulnerability that can lead to arbitrary code execution. It is crucial to update the package to a fixed version and apply input validation and sanitization to mitigate the risk. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for contao/core →
FAQ
contao/core is a PHP package that provides a content management system (CMS) for building websites. It offers various features such as user management, page creation, and template customization.
PHP object injection is a vulnerability that allows an attacker to inject malicious PHP objects into an application. This can lead to arbitrary code execution and potential compromise of the system.
To fix the vulnerability, it is recommended to update contao/core to a version that includes the fix. Refer to the package documentation or release notes for the specific version that addresses the issue.
No, only versions 2.0.0 to 2.11.14 and 3.0.0 to 3.2.5 are affected. It is important to check the version of contao/core used in your application and ensure it is updated to a patched version.
Yes, a temporary workaround is to validate and sanitize user-supplied data before passing it to the deserialize() function. This can help mitigate the risk of object injection. Refer to the provided code example in the 'workaround' section for more details.
References
Related vulnerabilities
Recent vulnerabilities recorded for contao/core.
