Zend-HTTP URL Rewrite vulnerability in zendframework/zend-http
Summary
GHSA-cg8w-5jrc-675g: Zend-HTTP URL Rewrite vulnerability. Affects zendframework/zend-http versions >= 1.0.0, < 2.8.1. Fixed in 2.8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
zendframework/zend-http is a package available on Packagist that provides functionality for handling HTTP requests and responses in PHP applications. It is commonly used in Zend Framework MVC projects. This package is vulnerable to a URL rewrite exploit that affects the marshaling of request URIs. The vulnerability arises from the package's logic that inspects HTTP request headers specific to a server-side URL rewrite mechanism. Even on systems not running the specific URL rewriting mechanism, the logic can be triggered by emulating the headers, allowing malicious clients or proxies to request arbitrary content.
Vulnerability Detail
The vulnerability in zendframework/zend-http allows for a potential URL rewrite exploit. By manipulating HTTP request headers, an attacker can bypass the intended behavior of the package and request arbitrary content. This can lead to unauthorized access, data leakage, or other security breaches. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
2.8.1
This is the first release that contains the fix.
composer require zendframework/zend-http:2.8.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the package to the fixed version as soon as possible.
Conclusion
The zendframework/zend-http package is vulnerable to a URL rewrite exploit that allows attackers to manipulate HTTP request headers and request arbitrary content. To mitigate this vulnerability, it is crucial to update the package to version 2.8.1 or later. There are no known workarounds, and it is recommended to apply the fix as soon as possible.
See every vulnerability recorded for zendframework/zend-http →
FAQ
The vulnerability allows attackers to manipulate HTTP request headers and request arbitrary content, potentially leading to unauthorized access or data leakage.
Versions 1.0.0 to 2.8.0 of zendframework/zend-http are affected by this vulnerability.
There are no known public exploits for this vulnerability at the time of writing.
Yes, this vulnerability can be exploited remotely by sending manipulated HTTP request headers.
Yes, the CVSS score for this vulnerability is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for zendframework/zend-http.
