ZendFramework1: Local File Inclusion in Zend_View::setScriptPath() and render()
Summary
GHSA-hx3m-959f-v849: ZendFramework local file inclusion vector in Zend_View::setScriptPath() and render(). Affects zendframework/zendframework1 versions >= 1.7.0, < 1.7.5. Fixed in 1.7.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ZendFramework1 is a popular PHP framework that includes the Zend_View component. Zend_View utilizes PHP as a templating language and allows users to specify 'script paths' containing view scripts. These view scripts are rendered using the render() method, which returns the output as a string value. However, versions up to and including 1.7.4 of ZendFramework1 are vulnerable to a Local File Inclusion (LFI) attack. This vulnerability arises when untrusted input is used to specify the script path or view script, potentially allowing an attacker to render system files.
Vulnerability Detail
The vulnerability in ZendFramework1 lies in the setScriptPath() method and the render() method of Zend_View. If an attacker can control the input to these methods, they can provide a malicious script path or view script that includes system files. For example, if the attacker supplies the string '/etc/passwd' or a relative path that resolves to that file, the file would be rendered. This can lead to unauthorized access to sensitive system files and potential information disclosure.
How To Fix
Minimum fixed version
1.7.5
This is the first release that contains the fix.
composer require zendframework/zendframework1:1.7.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately possible, a temporary workaround is to sanitize and validate user input before passing it to the setScriptPath() and render() methods. This can be done by ensuring that the provided script paths and view scripts are within the expected directory structure and do not allow access to system files. Here is an example of how input validation can be implemented in PHP:
$scriptPath = '/path/to/scripts/';
$viewScript = $_GET['view_script'];
if (strpos($viewScript, '..') === false) {
$view->setScriptPath($scriptPath);
$view->render($viewScript);
} else {
// Handle invalid input
}
Conclusion
ZendFramework1 versions up to and including 1.7.4 are vulnerable to a Local File Inclusion (LFI) attack in the setScriptPath() and render() methods of Zend_View. This vulnerability allows an attacker to specify a malicious script path or view script, potentially leading to the rendering of system files. To mitigate this vulnerability, it is recommended to upgrade to ZendFramework1 version 1.7.5 or later. If immediate upgrade is not possible, input validation and sanitization can be implemented as a temporary workaround. It is important to address this vulnerability promptly due to its high severity level.
See every vulnerability recorded for zendframework/zendframework1 →
FAQ
ZendFramework1 is a PHP framework that provides a set of tools and components for building web applications. It follows the Model-View-Controller (MVC) architectural pattern and offers features like database integration, form handling, and session management.
Local File Inclusion (LFI) is a type of vulnerability that allows an attacker to include files from the local system. By manipulating input parameters that specify file paths, an attacker can trick the application into rendering arbitrary files, potentially leading to unauthorized access and information disclosure.
The impact of this vulnerability can vary depending on the files that can be accessed through the LFI vector. In the case of ZendFramework1, if an attacker can render system files, they may be able to access sensitive information such as configuration files, user credentials, or other sensitive data stored on the server.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the composer.lock file. It provides an easy way to assess the security of your application without requiring access to the code or installation.
Yes, the CVSS score for this vulnerability is 7.5, indicating a high severity level. It is important to address this vulnerability promptly to prevent potential unauthorized access and information disclosure.
Related vulnerabilities
Recent vulnerabilities recorded for zendframework/zendframework1.
