p PatchFirst

GHSA-96c6-m98x-hxjx

GHSA-96c6-m98x-hxjx · Zend-Session session validation vulnerability

This page contains facts from public vulnerability sources. Check the original advisory before updating.

`Zend\Session` session validators do not work as expected if set prior to the start of a session. For instance, the following test case fails (where $this->manager is an instance of `Zend\Session\SessionManager`): ``` $this ->manager ->getValidatorChain() ->attach('session.validate', array(new RemoteAddr(), 'isValid')); $this->manager->start(); $this->assertSame( array( 'Zend\Session\Validator\RemoteAddr' =3D> '', ), $_SESSION['__ZF']['_VALID'] ); ``` The implication is that subsequent calls to `Zend\Session\SessionManager#start()` (in later requests, assuming a session was created) will not have any validator metadata attached, which causes any validator metadata to be re-built from scratch, thus marking the session as valid. An attacker is thus able to simply ignore session validators such as `RemoteAddr` or `HttpUserAgent`, since the "signature" that these validators check against is not being stored in the session.

CVSS 6.5 · Medium · Fix available

Published
Updated

Stack: php

Affected products and versions

  • zendframework/zend-session Packagist

    Versions
    • 2.0.3
    • 2.0.4
    • 2.0.5
    • 2.0.6
    • 2.0.7
    • 2.0.8
    • 2.1.0
    • 2.1.1
    • 2.1.2
    • 2.1.3
    • 2.1.4
    • 2.1.5
    • 2.1.6
    • 2.2.0
    • 2.2.0rc1
    • 2.2.0rc2
    • 2.2.0rc3
    • 2.2.1
    • 2.2.2
    • 2.2.3
    • 2.2.4
    • 2.2.5
    • 2.2.6
    • 2.2.7
    • 2.2.8
    Affected ranges
    • ECOSYSTEM: ≥ 2.0.0, < 2.2.9

    Update to 2.2.9

  • zendframework/zend-session Packagist

    Versions
    • 2.3.0
    • 2.3.1
    • 2.3.2
    • 2.3.3
    Affected ranges
    • ECOSYSTEM: ≥ 2.3.0, < 2.3.4

    Update to 2.3.4

Original sources

Check your server →