Session Validation Flaw in Zend-Session Package: A Security Concern
Summary
GHSA-96c6-m98x-hxjx: Zend-Session session validation vulnerability. Affects zendframework/zend-session across 2 version ranges.
>= 2.0.0, < 2.2.9
>= 2.3.0, < 2.3.4
Fixed in 2.2.9 or 2.3.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Zend-Session is a component of the Zend Framework, designed to manage user sessions in PHP applications. It provides features such as session storage, session validation, and the ability to attach custom validators to enhance security. However, a recent vulnerability has been identified that affects the session validation process, potentially allowing attackers to bypass security measures.
Vulnerability Detail
The vulnerability arises from the improper functioning of session validators in the Zend-Session package when they are set before starting a session. Specifically, if validators like RemoteAddr are attached before the session starts, they do not retain the necessary metadata in the session. This oversight means that subsequent session starts do not carry over the validation checks, allowing attackers to exploit this flaw by circumventing session validation mechanisms, such as ignoring checks for the user's IP address or user agent.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.0.0, < 2.2.92.2.9composer require zendframework/zend-session:2.2.9 -
>= 2.3.0, < 2.3.42.3.4composer require zendframework/zend-session:2.3.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, developers can ensure that session validators are attached after the session has been started. For example, the following code snippet demonstrates how to properly attach a validator after starting the session:
$this->manager->start();
$this->manager->getValidatorChain()->attach('session.validate', array(new RemoteAddr(), 'isValid'));
Conclusion
The Zend-Session vulnerability presents a significant risk by allowing attackers to bypass session validation mechanisms. It is essential for developers using this package to update to the latest patched versions and implement recommended workarounds to secure their applications effectively.
See every vulnerability recorded for zendframework/zend-session →
FAQ
The vulnerability allows attackers to bypass session validation, potentially leading to unauthorized access to user sessions.
You can use Vulert's playground to check if your application is affected by this vulnerability without needing to sign up.
Versions 2.0.0 to 2.2.8 and 2.3.0 to 2.3.3 of Zend-Session are affected by this vulnerability.
Implement the workaround by attaching session validators after starting the session to mitigate the risk temporarily.
The CVSS score for this vulnerability is 6.5, indicating a moderate severity level.
