Critical XML eXternal Entity Injection Vulnerability in zendframework/zendframework1
Summary
GHSA-mhpx-3rv8-wrjm: ZendFramework potential XML eXternal Entity injection vectors. Affects zendframework/zendframework1 versions >= 1.12.0, < 1.12.4. Fixed in 1.12.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Zend Framework is an open-source framework for developing web applications and services in PHP. It provides a robust architecture and reusable components, allowing developers to build secure and scalable applications. However, certain components of Zend Framework, specifically those utilizing PHP's DOMDocument, SimpleXML, and xml_parse functionalities, are vulnerable to XML eXternal Entity (XXE) injection attacks and XML Entity Expansion (XEE) vectors, which can lead to severe security issues.
Vulnerability Detail
The vulnerability arises from the insecure default settings of PHP's XML handling extensions, which allow external entities to be specified in XML documents. This can lead to XML eXternal Entity (XXE) injection attacks, where an attacker can manipulate the XML input to access sensitive files or establish unauthorized TCP connections. Additionally, XML Entity Expansion (XEE) attacks can occur when the XML DOCTYPE declaration includes recursive or circular references, resulting in excessive CPU and memory consumption, potentially causing Denial of Service (DoS) conditions.
How To Fix
Minimum fixed version
1.12.4
This is the first release that contains the fix.
composer require zendframework/zendframework1:1.12.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot immediately update the package, consider disabling the loading of external entities in your XML processing code. For example, when using DOMDocument, you can disable external entity loading as follows:
$dom = new DOMDocument();
$dom->loadXML($xmlString, LIBXML_NOENT | LIBXML_DTDLOAD);
This will help mitigate the risk of XXE attacks until you can apply the official patch.
Conclusion
The zendframework/zendframework1 package is vulnerable to critical XML eXternal Entity injection and XML Entity Expansion attacks. It is crucial to update to version 1.12.4 or later to mitigate these risks. Additionally, implementing workarounds can provide temporary relief until a full update can be performed.
See every vulnerability recorded for zendframework/zendframework1 →
FAQ
XXE injection attacks occur when an XML parser processes external entities, allowing attackers to read sensitive files or perform unauthorized actions.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your composer.lock file.
XEE attacks can lead to Denial of Service (DoS) by exhausting system resources, causing the application to become unresponsive.
To prevent such vulnerabilities, always validate and sanitize XML input, and keep your dependencies updated to the latest secure versions.
If an immediate update is not possible, implement workarounds such as disabling external entity loading in your XML processing code.
Related vulnerabilities
Recent vulnerabilities recorded for zendframework/zendframework1.
