Cross-site Scripting Vulnerability in ZendFramework zend-view
Summary
GHSA-m7hr-j867-3f34: ZendFramework has potential Cross-site Scripting vector in multiple view helpers. Affects zendframework/zend-view across 2 version ranges.
>= 2.0.0, < 2.2.7
>= 2.3.0, < 2.3.1
Fixed in 2.2.7 or 2.3.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
ZendFramework is an open-source PHP framework that provides a collection of professional PHP packages. The zend-view package is a component of ZendFramework that offers various view helpers for generating HTML content. These view helpers assist in rendering forms, navigation menus, and other HTML elements. However, a vulnerability has been identified in multiple view helpers of zend-view that can potentially lead to cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability arises from the improper usage of the escapeHtml() view helper instead of the more appropriate escapeHtmlAttr() helper in many Zend Framework 2 view helpers. This issue affects the following components:
- All
Zend\Formview helpers - Most
Zend\Navigation(akaZend\View\Helper\Navigation\*) view helpers - All "HTML Element" view helpers:
htmlFlash(),htmlPage(),htmlQuickTime() Zend\View\Helper\Gravatar
When user data or JavaScript is used to populate HTML attributes, the incorrect usage of escapeHtml() can result in potential XSS attack vectors. An attacker may exploit this vulnerability to inject malicious code into web pages, compromising the security and integrity of the application.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.0.0, < 2.2.72.2.7composer require zendframework/zend-view:2.2.7 -
>= 2.3.0, < 2.3.12.3.1composer require zendframework/zend-view:2.3.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a fixed version is not immediately feasible, a temporary workaround can be implemented by manually modifying the affected view helpers to use escapeHtmlAttr() instead of escapeHtml(). Here is an example of how to update the Zend\Form view helper:
// Before
echo $this->formText('name', $value, ['class' => $class]);
// After
echo $this->formText('name', $value, ['class' => $this->escapeHtmlAttr($class)]);
Conclusion
The zend-view package in ZendFramework is vulnerable to cross-site scripting (XSS) attacks due to the improper usage of the escapeHtml() view helper. Upgrading to a fixed version or manually modifying the affected view helpers to use escapeHtmlAttr() can mitigate this vulnerability. It is crucial to address this issue promptly to protect the application from potential security breaches.
See every vulnerability recorded for zendframework/zend-view →
FAQ
ZendFramework is an open-source PHP framework that provides a collection of professional PHP packages. It offers a robust set of tools and components for building web applications.
The zend-view package is a component of ZendFramework that provides various view helpers for generating HTML content. These helpers assist in rendering forms, navigation menus, and other HTML elements.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to the theft of sensitive information or the execution of unauthorized actions.
An attacker can exploit this vulnerability by injecting malicious code into web pages that utilize the vulnerable view helpers. This code can be executed by unsuspecting users, leading to potential data theft or unauthorized actions.
To fix this vulnerability, it is recommended to update the zend-view package to a fixed version that includes the necessary security patches. This will ensure that the appropriate escapeHtmlAttr() helper is used, mitigating the XSS vulnerability.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
