URL Validation Flaw in PHP Packages: CVE-2021-21705
Summary
UBUNTU-CVE-2021-21705: In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using URL validation functionality via filter_var() function with FILTER_VALIDATE_URL parameter, an URL with invalid password field can b... Affects php5 versions < 5.5.9+dfsg-1ubuntu4.29+esm14. Fixed in 5.5.9+dfsg-1ubuntu4.29+esm14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a widely-used open-source scripting language designed for web development but also used as a general-purpose programming language. It is known for its ease of use, flexibility, and extensive community support. The affected packages include various PHP versions (5, 7.0, 7.2, 7.4) that are integral to running web applications. This vulnerability allows for improper URL validation, which can lead to security risks.
Vulnerability Detail
In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21, and 8.0.x below 8.0.8, the filter_var() function with the FILTER_VALIDATE_URL parameter can incorrectly accept URLs with invalid password fields as valid. This flaw can lead to incorrect URL parsing, potentially causing the application to contact the wrong server or make erroneous access decisions, thereby exposing sensitive data or allowing unauthorized access.
How To Fix
Minimum fixed version
5.5.9+dfsg-1ubuntu4.29+esm14
This is the first release that contains the fix.
sudo apt-get install --only-upgrade php5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the filter_var() function for URL validation until the package is updated. Instead, implement custom validation logic that checks for valid URL formats without relying on the flawed function.
Conclusion
CVE-2021-21705 presents a significant risk to PHP applications due to improper URL validation. It is crucial to update affected PHP packages to their patched versions to mitigate this vulnerability. Additionally, temporary workarounds should be implemented until updates are applied.
See every vulnerability recorded for php5 →
FAQ
CVE-2021-21705 is a vulnerability in PHP that allows invalid URLs to be accepted by the filter_var() function, leading to potential security risks.
The affected versions include PHP 7.3.x below 7.3.29, 7.4.x below 7.4.21, and 8.0.x below 8.0.8.
The vulnerability can lead to incorrect URL parsing, which may result in contacting the wrong server or making unauthorized access decisions.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score for CVE-2021-21705 is 5.3, indicating a medium severity level.
Related vulnerabilities
Recent vulnerabilities recorded for php5.
