Zend Framework remote code execution vulnerability revealed

guest · Jan 4, 2021

Zend Framework remote code execution vulnerability revealed
January 4, 2021
https://www.bleepingcomputer.com/ne...remote-code-execution-vulnerability-revealed/

An untrusted deserialization vulnerability disclosed this week in Zend Framework can be exploited by attackers to achieve remote code execution on PHP sites.

This vulnerability tracked as CVE-2021-3007 may also impact some instances of Laminas Project, Zend's successor.
Zend Framework consists of PHP packages installed over 570 million times. The framework is used by developers to build object-oriented web applications.
Click to expand...

From untrusted deserialization to RCE
This week, security researcher Ling Yizhou has disclosed an untrusted deserialization vulnerability in Zend Framework 3.0.0.

If exploited, the flaw can allow remote attackers to conduct remote code execution (RCE) attacks on vulnerable PHP applications under certain circumstances.

"Zend Framework 3.0.0 has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the __destruct method of the Zend\Http\Response\Stream class in Stream.php," states MITRE's advisory for CVE-2021-3007.
Click to expand...

Considering PHP powers about 80% of the internet sites in some capacity, and given the historic popularity of Zend Framework, developers are advised to thoroughly check their web applications for cases of untrusted object deserialization.
Click to expand...

guest · Jan 5, 2021

mood said: ↑

Zend Framework remote code execution vulnerability revealed January 4, 2021
Click to expand...

Updated (January 5, 2021):

Update 5-Jan-2021: Clarified the gadget chain in Zend Framework may aid in achieving RCE for an application vulnerable to untrusted deserialization.
Laminas Project has issued a patch on GitHub to update the aforementioned destructor in Stream class.
Click to expand...

Log in or Sign up

Zend Framework remote code execution vulnerability revealed

guest Guest

guest Guest

Log in or Sign up

Zend Framework remote code execution vulnerability revealed

guest Guest

guest Guest

Useful Searches