Arbitrary URL Rewrite Affecting zendframework/zend-diactoros package, versions <1.8.4
Snyk CVSS
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PHP-ZENDFRAMEWORKZENDDIACTOROS-72255
- published 2 Aug 2018
- disclosed 2 Aug 2018
- credit Drupal Security Team
How to fix?
Upgrade zendframework/zend-diactoros
to version 1.8.4 or higher.
Overview
zendframework/zend-diactoros contains implementations of the accepted PSR-7 HTTP message interfaces, as well as a "server" implementation similar to node's http.Server
.
Affected versions of this package are vulnerable to an Arbitrary URL Rewrite vulnerability. The request URI marshaling process contains logic that inspects HTTP request headers that are specific to a given server-side URL rewrite mechanism.
When these headers are present on systems not running the specific URL rewriting mechanism, the URLs are subject to rewriting, allowing a malicious client or proxy to emulate the headers to request arbitrary content.