{"uuid": "47022ec7-45f7-4fc0-a9ab-47badd4d7267", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-m557-wrgg-6rp4", "type": "seen", "source": "https://gist.github.com/alon710/2ea9580acec8d03d5972005197773fa7", "content": "# GHSA-M557-WRGG-6RP4: GHSA-m557-wrgg-6rp4: Server-Side Request Forgery via Authority Information Access (AIA) Chasing in phpseclib\n\n> **CVSS Score:** 5.8\n> **Published:** 2026-06-16\n> **Full Report:** https://cvereports.com/reports/GHSA-M557-WRGG-6RP4\n\n## Summary\nThe PHP Secure Communications Library (phpseclib) contains a Server-Side Request Forgery (SSRF) vulnerability due to an insecure default implementation of Authority Information Access (AIA) certificate chasing. This flaw allows remote, unauthenticated attackers to coerce applications validating user-supplied X.509 certificates into generating arbitrary outbound HTTP requests to internal networks or local interfaces.\n\n## TL;DR\nAn insecure default configuration in phpseclib enables dynamic retrieval of Certificate Authority certificates via Authority Information Access (AIA) extensions. Because these target URLs are extracted directly from user-supplied certificates and processed without destination validation, attackers can initiate arbitrary outbound GET requests to internal networks and cloud metadata servers.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-918\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1**: 5.8\n- **Impact**: Server-Side Request Forgery\n- **Exploit Status**: Proof of Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- phpseclib/phpseclib (Packagist/Composer Package)\n- **phpseclib**: >= 0.1.1, < 1.0.30 (Fixed in: `1.0.30`)\n- **phpseclib**: >= 2.0.0, < 2.0.55 (Fixed in: `2.0.55`)\n- **phpseclib**: >= 3.0.0, < 3.0.54 (Fixed in: `3.0.54`)\n\n## Mitigation\n\n- Upgrade phpseclib/phpseclib to a patched version (1.0.30, 2.0.55, or 3.0.54).\n- Deactivate dynamic URL fetching globally using X509::disableURLFetch() if intermediate certificate chasing is not required.\n- Register a secure fetch callback via X509::setURLFetchCallback() to enforce IP and domain blocklists on outbound requests.\n\n**Remediation Steps:**\n1. Identify all instances of phpseclib in the composer.lock file and update the package reference.\n2. For temporary mitigation, append X509::disableURLFetch() immediately after initializing phpseclib classes.\n3. Implement an IP validation filter inside the custom callback to block private subnets, loopback interfaces, and multicast addresses.\n\n## References\n\n- [GitHub Security Advisory GHSA-m557-wrgg-6rp4](https://github.com/advisories/GHSA-m557-wrgg-6rp4)\n- [phpseclib Project Advisory](https://github.com/phpseclib/phpseclib/security/advisories/GHSA-m557-wrgg-6rp4)\n- [phpseclib Repository](https://github.com/phpseclib/phpseclib)\n- [phpseclib 3.0.54 Release Notes](https://github.com/phpseclib/phpseclib/releases/tag/3.0.54)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-M557-WRGG-6RP4) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-06-16T15:41:15.000000Z"}