GHSA-9v78-h226-2rmq
Zendframework potential security issue in login mechanism
- Severity
- 7.5 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-287 Improper Authentication
- Fix
1.12.4- Upgrade zendframework/zendframework1 to this version or later
Description
Using the Consumer component of ZendOpenId (or Zend_OpenId in ZF1), it is possible to login using an arbitrary OpenID account (without knowing any secret information) by using a malicious OpenID Provider. That means OpenID it is possible to login using arbitrary OpenID Identity (MyOpenID, Google, etc), which are not under the control of our own OpenID Provider. Thus, we are able to impersonate any OpenID Identity against the framework.
Moreover, the Consumer accepts OpenID tokens with arbitrary signed elements. The framework does not check if, for example, both openid.claimed_id and openid.endpoint_url are signed. It is just sufficient to sign one parameter. According to https://openid.net/specs/openid-authentication-2_0.html#positive_assertions, at least op_endpoint, return_to, response_nonce, assoc_handle, and, if present in the response, claimed_id and identity, must be signed.
Affected versions
Packagist
| Package | Vulnerable | Fixed in |
|---|---|---|
| zendframework/zendframework1 | >= 1.12.0, < 1.12.4 |
1.12.4 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
zendframework/zendframework1 Packagist → 1.12.4
- composer
composer require zendframework/zendframework1:^1.12.4
Severity breakdown
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Weakness
CWE-287: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
How to prevent it
- Architecture and Design: Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
References
Packages
Other links
Timeline
- Published
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-6fqw-j3vm-7f66 Zendframework1 Potential SQL injection in ORDER and GROUP functions | Critical | Also affects zendframework/zendframework1 |
| GHSA-848f-mph5-9pm9 Zendframework Potential Information Disclosure and Insufficient Entropy vulnerability | High | Also affects zendframework/zendframework1 |
| GHSA-8xhv-gqm4-3w99 ZendFramework1 Potential Insufficient Entropy Vulnerability | High | Also affects zendframework/zendframework1 |
| GHSA-v42g-7q2x-cw32 Zendframework1 potential SQL injection vector using null byte for PDO (MsSql, SQLite) | Critical | Also affects zendframework/zendframework1 |
| GHSA-2x36-qhx3-7m5f ZendFramework1 Potential SQL injection in the ORDER implementation of Zend_Db_Select | Critical | Also affects zendframework/zendframework1 |
| GHSA-4vf6-mq7w-3hp6 Zend_Filter_StripTags vulnerable to Cross-site Scripting when comments allowed | Medium | Also affects zendframework/zendframework1 |
| GHSA-4v57-pwvf-x35j Zendframework potential Cross-site Scripting vector in `Zend_Service_ReCaptcha_MailHide` | Medium | Also affects zendframework/zendframework1 |
| GHSA-vvm3-rv48-j3g5 Zendframework Potential XSS or HTML Injection vector in Zend_Json | Medium | Also affects zendframework/zendframework1 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor