Critical XML Parsing Vulnerability in PHP Packages: CVE-2021-21707
Summary
UBUNTU-CVE-2021-21707: In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexml_load_file(), URL-decode the filename passed to them. Affects php5 versions 5.5.3+dfsg-1ubuntu2 – 5.5.9+dfsg-1ubuntu4.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a widely-used open-source scripting language designed for web development but also used as a general-purpose programming language. It is known for its ease of use, flexibility, and extensive community support. The affected packages include various versions of PHP (5.5, 7.0, 7.2, 7.4) that are integral for running dynamic web applications. This vulnerability can lead to unintended file access due to improper handling of URL-encoded filenames in XML parsing functions.
Vulnerability Detail
In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26, and 8.0.x below 8.0.13, certain XML parsing functions, like simplexml_load_file(), URL-decode the filename passed to them. If that filename contains a URL-encoded NUL character, this may cause the function to interpret this as the end of the filename, leading to the reading of a different file than intended. This could expose sensitive data or allow unauthorized access to files, posing a significant security risk.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using URL-encoded filenames with NUL characters in XML parsing functions until the package can be updated. Ensure that all filenames passed to these functions are properly sanitized and validated.
Conclusion
The CVE-2021-21707 vulnerability poses a significant risk to applications using affected PHP versions due to improper handling of filenames in XML parsing functions. It is crucial to update to the patched versions of PHP to mitigate this risk and ensure the security of your applications.
See every vulnerability recorded for php5 →
FAQ
CVE-2021-21707 is a vulnerability in certain PHP versions that allows improper handling of URL-encoded filenames in XML parsing functions, potentially leading to unauthorized file access.
The affected PHP versions include 7.3.x below 7.3.33, 7.4.x below 7.4.26, and 8.0.x below 8.0.13.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If an immediate update is not possible, ensure that you avoid using URL-encoded filenames with NUL characters in XML parsing functions as a temporary workaround.
The CVSS score of this vulnerability is 5.3, indicating a moderate level of risk.
Related vulnerabilities
Recent vulnerabilities recorded for php5.
