Zendframework Vulnerable to XXE/XEE Attacks
Summary
GHSA-qc7w-4567-84wv: Zendframework vulnerable to XXE/XEE attacks. Affects zendframework/zendframework across 2 version ranges.
>= 2.1.0, < 2.1.6
>= 2.2.0, < 2.2.6
Fixed in 2.1.6 or 2.2.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Zendframework is an open-source PHP framework that provides a collection of professional PHP packages. It is widely used for developing web applications and services. The framework offers various components that utilize PHP's DOMDocument, SimpleXML, and xml_parse functionality for XML processing. Unfortunately, these components are vulnerable to XML eXternal Entity (XXE) and XML Entity Expansion (XEE) attacks.
Vulnerability Detail
The vulnerability in Zendframework arises from the insecure default behavior of the DOMDocument, SimpleXML, and xml_parse functionality. This allows for two types of attacks:
-
XML eXternal Entity (XXE) Injection attacks: By adding a specific DOCTYPE element to XML documents or strings, an attacker can exploit this vulnerability to coerce the application into opening arbitrary files or TCP connections. This can lead to unauthorized access to sensitive information or remote code execution.
-
XML Entity Expansion (XEE) vectors: XEE attacks occur when the XML DOCTYPE declaration includes XML entity definitions with recursive or circular references. This can cause excessive CPU and memory consumption, leading to Denial of Service (DoS) attacks where the application becomes unresponsive or crashes.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.1.0, < 2.1.62.1.6composer require zendframework/zendframework:2.1.6 -
>= 2.2.0, < 2.2.62.2.6composer require zendframework/zendframework:2.2.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating Zendframework is not immediately feasible, a temporary workaround is to disable the loading of external entities in the XML processing components. This can be achieved by setting the LIBXML_NOENT flag when using DOMDocument or SimpleXML. Here's an example:
libxml_disable_entity_loader(true);
Conclusion
Zendframework is vulnerable to XXE and XEE attacks due to insecure XML processing in components utilizing PHP's DOMDocument, SimpleXML, and xml_parse functionality. These vulnerabilities can lead to unauthorized access, remote code execution, and Denial of Service (DoS) attacks. It is crucial to update Zendframework to versions 2.1.6 or 2.2.6 to mitigate these risks. Additionally, disabling the loading of external entities can serve as a temporary workaround.
See every vulnerability recorded for zendframework/zendframework →
FAQ
Zendframework is an open-source PHP framework used for developing web applications and services.
XXE (XML eXternal Entity) attacks exploit insecure XML processing to access arbitrary files or initiate TCP connections. XEE (XML Entity Expansion) attacks cause excessive CPU and memory consumption, leading to Denial of Service (DoS) attacks.
XXE attacks can lead to unauthorized access to sensitive information or remote code execution. XEE attacks can cause the application to become unresponsive or crash, resulting in service disruption.
To fix the vulnerability, update Zendframework to versions 2.1.6 or 2.2.6, which include patches for the XXE and XEE vulnerabilities.
Yes, a temporary workaround is to disable the loading of external entities in the XML processing components by setting the LIBXML_NOENT flag.
References
Related vulnerabilities
Recent vulnerabilities recorded for zendframework/zendframework.
