GHSA-8x2v-pcg7-94f4: Zend-JSON vulnerable to XXE/XEE attacks
Numerous components utilizing PHP’s DOMDocument, SimpleXML, and xml_parse functionality are vulnerable to two types of attacks:
- XML eXternal Entity (XXE) Injection attacks. The above mentioned extensions are insecure by default, allowing external entities to be specified by adding a specific DOCTYPE element to XML documents and strings. By exploiting this vulnerability an application may be coerced to open arbitrary files and/or TCP connections.
- XML Entity Expansion (XEE) vectors, leading to Denial of Service vectors. XEE attacks occur when the XML DOCTYPE declaration includes XML entity definitions that contain either recursive or circular references; this leads to CPU and memory consumption, making Denial of Service exploits trivial to implement.
References
- framework.zend.com/security/advisory/ZF2014-01
- github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zend-json/ZF2014-01.yaml
- github.com/advisories/GHSA-8x2v-pcg7-94f4
- github.com/zendframework/zend-json
- github.com/zendframework/zend-json/commit/078e77a6e59cdbf32a94691afe3523db340f5da9
- github.com/zendframework/zend-json/commit/7a747fbefe566c28a94b7e7ca37c15fc09ba4754
- github.com/zendframework/zend-json/commit/865f96ecbc5e080fccb5e75304ce06ac57d2ce22
- github.com/zendframework/zend-json/commit/89fc6f760478dc15519cb3ef4e4976425dc6ee10
- github.com/zendframework/zend-json/commit/9fe5103dc9be472fa0a443ca36619a2953b6f88e
- github.com/zendframework/zend-json/commit/acc60fc3fe56f5b0ad218c4c5789b21f11bc3a89
Code Behaviors & Features
Detect and mitigate GHSA-8x2v-pcg7-94f4 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →