High Severity XML eXternal Entity Injection Vulnerability in ZendFramework 1
Summary
GHSA-4j9x-g4x8-vcmf: ZendFramework potential XML eXternal Entity injection vectors. Affects zendframework/zendframework1 across 2 version ranges.
>= 1.11.0, < 1.11.15
>= 1.12.0, < 1.12.1
Fixed in 1.11.15 or 1.12.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ZendFramework is a popular open-source framework for developing web applications and services in PHP. It provides a robust set of components and tools for building scalable and maintainable applications. However, certain versions of ZendFramework 1 have been found to be vulnerable to XML eXternal Entity (XXE) injection, which can lead to unauthorized access to sensitive files and network resources.
Vulnerability Detail
The vulnerability arises from the insecure usage of PHP's DOM extension in the Zend_Feed_Rss and Zend_Feed_Atom components. Attackers can exploit this vulnerability by crafting malicious XML feeds that include a specific DOCTYPE declaration, allowing them to specify external entities. This can lead to the opening of arbitrary files on the server or establishing unauthorized TCP connections, posing a significant security risk.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.11.0, < 1.11.151.11.15composer require zendframework/zendframework1:1.11.15 -
>= 1.12.0, < 1.12.11.12.1composer require zendframework/zendframework1:1.12.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation to sanitize XML feeds and prevent the inclusion of malicious DOCTYPE declarations. Additionally, disable the loading of external entities in your XML parser settings if possible.
Conclusion
The XML eXternal Entity injection vulnerability in ZendFramework 1 poses a significant risk to applications using affected versions. It is crucial to update to the patched versions to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and manage vulnerabilities in your software effectively.
See every vulnerability recorded for zendframework/zendframework1 →
FAQ
XXE injection is a type of attack that exploits vulnerabilities in XML parsers. It allows attackers to manipulate XML input to access sensitive data or perform unauthorized actions.
The vulnerability affects ZendFramework 1 versions from 1.11.0 to 1.11.14 and from 1.12.0 to 1.12.0.
You can use Vulert, a tool that monitors open-source vulnerabilities in your software. By uploading your composer.lock file, you can receive real-time alerts about vulnerabilities, including this one.
Exploitation of this vulnerability can lead to unauthorized access to sensitive files on the server and the ability to make arbitrary network connections, which can compromise the security of the application.
Yes, you can implement input validation to sanitize XML feeds and disable external entity loading in your XML parser settings as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for zendframework/zendframework1.
