High Severity Information Disclosure Vulnerability in Zend Framework 1 - Zend_Captcha_Word
Summary
GHSA-848f-mph5-9pm9: Zendframework Potential Information Disclosure and Insufficient Entropy vulnerability. Affects zendframework/zendframework1 versions >= 1.12.0, < 1.12.17. Fixed in 1.12.17. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Zend Framework is an open-source framework for developing web applications and services in PHP. It provides a robust set of components for building secure and maintainable applications. One of its components, Zend_Captcha, is used to generate CAPTCHA challenges to prevent automated submissions. However, a vulnerability exists in the way it generates random words for these challenges, which could lead to potential information disclosure.
Vulnerability Detail
The vulnerability arises from the use of PHP's internal array_rand() function in the Zend_Captcha_Word component of Zend Framework. This function relies on the rand() method, which does not provide sufficient entropy for secure random number generation. As a result, an attacker could exploit this weakness to brute force the CAPTCHA generation process, potentially leading to unauthorized access or information disclosure. The vulnerability is classified under CWE-331, indicating insufficient entropy in random number generation.
How To Fix
Minimum fixed version
1.12.17
This is the first release that contains the fix.
composer require zendframework/zendframework1:1.12.17Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot immediately update the package, consider implementing a custom CAPTCHA solution that uses a more secure random number generation method, such as openssl_random_pseudo_bytes(). This can help mitigate the risk until you can apply the official patch.
Conclusion
The Zend Framework 1 has a significant vulnerability in its CAPTCHA generation mechanism due to insufficient entropy in random number generation. It is crucial to update to version 1.12.17 or later to mitigate the risk of information disclosure. Users should also consider alternative CAPTCHA implementations as a temporary measure.
See every vulnerability recorded for zendframework/zendframework1 →
FAQ
The vulnerability has a CVSS score of 7.5, indicating a high severity level.
The vulnerability affects Zend Framework 1 versions prior to 1.12.17.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability could allow attackers to bypass CAPTCHA protections, leading to unauthorized access or data exposure.
Yes, you can implement a custom CAPTCHA solution using more secure random number generation methods as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for zendframework/zendframework1.
