Information Disclosure and Insufficient Entropy in Zend-Captcha
Summary
GHSA-mg4x-prh7-g4mx: Zend-Captcha Information Disclosure and Insufficient Entropy vulnerability. Affects zendframework/zend-captcha across 2 version ranges.
>= 2.0.0, < 2.4.9
>= 2.5.0, < 2.5.2
Fixed in 2.4.9 or 2.5.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Zend-Captcha is a component of the Zend Framework that provides CAPTCHA functionality to prevent automated submissions on web forms. It generates challenges that require user interaction to verify that the user is human. The component is widely used in web applications to enhance security by reducing spam and bot activity. However, it has been identified that the method used to generate random letters for CAPTCHA challenges lacks sufficient entropy, making it vulnerable to brute force attacks.
Vulnerability Detail
The vulnerability arises from the use of PHP's internal array_rand() function in the Zend_Captcha_Word (v1) and Zend\Captcha\Word (v2) classes. This function relies on rand(), which does not provide adequate randomness for secure applications. As a result, an attacker could potentially predict the generated CAPTCHA words, leading to information disclosure and the ability to bypass CAPTCHA protections. This vulnerability is classified under CWE-331, indicating insufficient entropy in random number generation.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.0.0, < 2.4.92.4.9composer require zendframework/zend-captcha:2.4.9 -
>= 2.5.0, < 2.5.22.5.2composer require zendframework/zend-captcha:2.5.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate updating is not feasible, consider implementing a custom CAPTCHA solution that uses a more secure random number generation method, such as openssl_random_pseudo_bytes(). This can be done by overriding the CAPTCHA generation method in your application to ensure that it uses a cryptographically secure method for generating random letters.
Conclusion
The Zend-Captcha component of the Zend Framework has a vulnerability related to insufficient entropy in its CAPTCHA generation process. This can lead to serious security risks, including information disclosure. It is crucial to update to the latest patched versions to mitigate these risks. Additionally, using tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for zendframework/zend-captcha →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
The affected versions are 2.0.0 to 2.4.9 and 2.5.0 to 2.5.1.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The potential consequences include information disclosure and the ability for attackers to bypass CAPTCHA protections, which can lead to increased spam and automated submissions.
If you cannot update the package immediately, consider implementing a custom CAPTCHA solution that uses a more secure random number generation method.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
