Cross-Site Scripting Vulnerability in Zend Framework - Potential XSS Attack Vectors
Summary
GHSA-8q77-cv62-jj38: Zendframework has potential Cross-site Scripting vector in multiple view helpers. Affects zendframework/zendframework across 2 version ranges.
>= 2.0.0, < 2.2.7
>= 2.3.0, < 2.3.1
Fixed in 2.2.7 or 2.3.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Zend Framework is an open-source, object-oriented web application framework implemented in PHP 7. It provides a robust set of components for building web applications and services. The framework is widely used for its modularity and flexibility, allowing developers to create scalable applications. However, certain view helpers in Zend Framework 2 have been found to be vulnerable to cross-site scripting (XSS) attacks due to improper HTML attribute escaping.
Vulnerability Detail
The vulnerability arises from the use of the escapeHtml() view helper instead of the more appropriate escapeHtmlAttr() for escaping HTML attributes. This misstep can lead to scenarios where user data or JavaScript is injected into HTML attributes, creating potential XSS attack vectors. Affected view helpers include those in Zend\Form, Zend\Navigation, and various HTML element helpers. If exploited, this vulnerability could allow attackers to execute arbitrary JavaScript in the context of the user's browser, potentially compromising user data and session integrity.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.0.0, < 2.2.72.2.7composer require zendframework/zendframework:2.2.7 -
>= 2.3.0, < 2.3.12.3.1composer require zendframework/zendframework:2.3.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, developers can manually replace instances of escapeHtml() with escapeHtmlAttr() in their view helpers until the package is updated. For example:
// Original code
$escapedValue = $this->escapeHtml($userInput);
// Updated code
$escapedValue = $this->escapeHtmlAttr($userInput);
Conclusion
The identified cross-site scripting vulnerability in Zend Framework due to improper HTML attribute escaping poses a significant risk to applications using affected view helpers. It is crucial for developers to update to the patched versions to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for zendframework/zendframework →
FAQ
The CVSS score of this vulnerability is 6.1, indicating a moderate severity level.
Versions 2.0.0 to 2.2.6 and 2.3.0 are affected. The vulnerability is fixed in versions 2.2.7 and 2.3.1.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If exploited, this vulnerability could allow attackers to execute malicious scripts in users' browsers, leading to data theft, session hijacking, or other malicious activities.
Yes, you can manually replace escapeHtml() with escapeHtmlAttr() in your code as a temporary measure until you can update the package.
Related vulnerabilities
Recent vulnerabilities recorded for zendframework/zendframework.
