Cross-site Scripting Vulnerability in Zend Framework
Summary
GHSA-5gmf-3c43-q73v: ZendFramework vulnerable to Cross-site Scripting. Affects zendframework/zendframework versions >= 2.0.0, < 2.0.1. Fixed in 2.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Zend Framework is an open-source framework for developing web applications and services in PHP. It provides a robust architecture and a set of components that facilitate the development of secure and maintainable applications. However, certain components of Zend Framework, such as Zend\Debug, Zend\Feed\PubSubHubbub, and others, have been found to be vulnerable to Cross-site Scripting (XSS) attacks due to improper escaping of HTML and URLs.
Vulnerability Detail
The vulnerability arises from the failure of several components within Zend Framework to utilize the Zend\Escaper for escaping HTML, HTML attributes, and URLs. Although some components performed escaping, they did not use context-appropriate mechanisms, making them susceptible to XSS attacks. This could allow attackers to inject malicious scripts into web pages viewed by users, potentially leading to data theft, session hijacking, or other malicious activities.
How To Fix
Minimum fixed version
2.0.1
This is the first release that contains the fix.
composer require zendframework/zendframework:2.0.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that any output generated by the affected components is properly escaped using Zend\Escaper. For example, you can manually escape output like this: '$escapedOutput = Zend\Escaper\Escaper::
escapeHtml($output);
'. This will help mitigate the risk of XSS until the package is updated.
Conclusion
The Cross-site Scripting vulnerability in Zend Framework poses a significant risk to applications using affected components. It is crucial to update to the latest version to mitigate this risk. Additionally, using proper escaping techniques can help protect against potential attacks.
See every vulnerability recorded for zendframework/zendframework →
FAQ
XSS is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by users, potentially compromising user data and sessions.
Versions prior to 2.0.1 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Implement the workaround by manually escaping output using Zend\Escaper to reduce the risk of XSS until you can update the package.
The CVSS score of this vulnerability is 6.1, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for zendframework/zendframework.
