CVE-2024-11234

In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, when using streams with configured proxy and "request_fulluri" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests originating from the server, thus potentially gaining access to resources not normally available to the external user.

CVSS v3 4.8 MEDIUM

4.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/php/php-src/security/advisories/GHSA-c5f2-jwm7-mmq2	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:php:php::::::::
	cpe:2.3:a:php:php::::::::
	cpe:2.3:a:php:php::::::::

History

26 Nov 2024, 19:06

Type	Values Removed	Values Added
References	~~() https://github.com/php/php-src/security/advisories/GHSA-c5f2-jwm7-mmq2 -~~	() https://github.com/php/php-src/security/advisories/GHSA-c5f2-jwm7-mmq2 - Exploit, Third Party Advisory
Summary		(es) En las versiones de PHP 8.1.* anteriores a 8.1.31, 8.2.* anteriores a 8.2.26, 8.3.* anteriores a 8.3.14, cuando se utilizan flujos con proxy configurado y la opción "request_fulluri", la URI no se desinfecta correctamente, lo que puede provocar contrabando de solicitudes HTTP y permitir que el atacante use el proxy para realizar solicitudes HTTP arbitrarias que se originan en el servidor, obteniendo así potencialmente acceso a recursos que normalmente no están disponibles para el usuario externo.
CPE		cpe:2.3:a:php:php::::::::
CWE		CWE-74
First Time		Php php Php

24 Nov 2024, 01:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-11-24 01:15

Updated : 2024-11-26 19:06

NVD link : CVE-2024-11234

Mitre link : CVE-2024-11234

CVE.ORG link : CVE-2024-11234

JSON object : View

Products Affected

php

php

CWE

CWE-20

Improper Input Validation

CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

{"id": "CVE-2024-11234", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security@php.net", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 3.9}]}, "published": "2024-11-24T01:15:03.987", "references": [{"url": "https://github.com/php/php-src/security/advisories/GHSA-c5f2-jwm7-mmq2", "tags": ["Exploit", "Third Party Advisory"], "source": "security@php.net"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@php.net", "description": [{"lang": "en", "value": "CWE-20"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-74"}]}], "descriptions": [{"lang": "en", "value": "In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, when using streams with configured proxy and \"request_fulluri\" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests originating from the server, thus potentially gaining access to resources not normally available to the external user."}, {"lang": "es", "value": "En las versiones de PHP 8.1.* anteriores a 8.1.31, 8.2.* anteriores a 8.2.26, 8.3.* anteriores a 8.3.14, cuando se utilizan flujos con proxy configurado y la opci\u00f3n \"request_fulluri\", la URI no se desinfecta correctamente, lo que puede provocar contrabando de solicitudes HTTP y permitir que el atacante use el proxy para realizar solicitudes HTTP arbitrarias que se originan en el servidor, obteniendo as\u00ed potencialmente acceso a recursos que normalmente no est\u00e1n disponibles para el usuario externo."}], "lastModified": "2024-11-26T19:06:10.243", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CE6E1B68-3EB9-4C67-97A6-226EA02CC2EA", "versionEndExcluding": "8.1.31", "versionStartIncluding": "8.1.0"}, {"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C160D91A-CF97-4DD1-A34F-8B8C852B3CEC", "versionEndExcluding": "8.2.26", "versionStartIncluding": "8.2.0"}, {"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "35B1BA7F-0EAE-4F40-ACA4-EBC5D63F609A", "versionEndExcluding": "8.3.14", "versionStartIncluding": "8.3.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@php.net"}