cve-2024-11234
Vulnerability from cvelistv5
Published
2024-11-24 00:57
Modified
2024-11-24 12:41
Severity ?
4.8 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Summary
In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, when using streams with configured proxy and "request_fulluri" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests originating from the server, thus potentially gaining access to resources not normally available to the external user.
References
security@php.nethttps://github.com/php/php-src/security/advisories/GHSA-c5f2-jwm7-mmq2Exploit, Third Party Advisory
Impacted products
Vendor Product Version
PHP Group PHP Version: 8.1.*   ≤
Version: 8.2.*   ≤
Version: 8.3.*   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            affected: [
               {
                  cpes: [
                     "cpe:2.3:a:php_group:php:*:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "php",
                  vendor: "php_group",
                  versions: [
                     {
                        lessThan: "8.1.31",
                        status: "affected",
                        version: "8.1.0",
                        versionType: "custom",
                     },
                     {
                        lessThan: "8.2.26",
                        status: "affected",
                        version: "8.2.0",
                        versionType: "custom",
                     },
                     {
                        lessThan: "8.3.14",
                        status: "affected",
                        version: "8.3.0",
                        versionType: "custom",
                     },
                  ],
               },
               {
                  cpes: [
                     "cpe:2.3:a:php_group:php:*:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "php",
                  vendor: "php_group",
                  versions: [
                     {
                        lessThan: "8.1.31",
                        status: "affected",
                        version: "8.1.0",
                        versionType: "custom",
                     },
                     {
                        lessThan: "8.2.26",
                        status: "affected",
                        version: "8.2.0",
                        versionType: "custom",
                     },
                     {
                        lessThan: "8.3.14",
                        status: "affected",
                        version: "8.3.0",
                        versionType: "custom",
                     },
                  ],
               },
               {
                  cpes: [
                     "cpe:2.3:a:php_group:php:*:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "php",
                  vendor: "php_group",
                  versions: [
                     {
                        lessThan: "8.1.31",
                        status: "affected",
                        version: "8.1.0",
                        versionType: "custom",
                     },
                     {
                        lessThan: "8.2.26",
                        status: "affected",
                        version: "8.2.0",
                        versionType: "custom",
                     },
                     {
                        lessThan: "8.3.14",
                        status: "affected",
                        version: "8.3.0",
                        versionType: "custom",
                     },
                  ],
               },
            ],
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-11234",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-11-24T12:32:39.294616Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-11-24T12:41:42.763Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "PHP",
               vendor: "PHP Group",
               versions: [
                  {
                     lessThan: "8.1.31",
                     status: "affected",
                     version: "8.1.*",
                     versionType: "semver",
                  },
                  {
                     lessThan: "8.2.26",
                     status: "affected",
                     version: "8.2.*",
                     versionType: "semver",
                  },
                  {
                     lessThan: "8.3.14",
                     status: "affected",
                     version: "8.3.*",
                     versionType: "semver",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               type: "reporter",
               value: "Lorenzo Leonardini",
            },
         ],
         datePublic: "2024-11-21T18:15:00.000Z",
         descriptions: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "<span style=\"background-color: rgb(255, 255, 255);\">In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, when using streams with configured proxy and \"request_fulluri\" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests originating from the server, thus potentially gaining access to resources not normally available to the external user.&nbsp;</span><br>",
                  },
               ],
               value: "In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, when using streams with configured proxy and \"request_fulluri\" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests originating from the server, thus potentially gaining access to resources not normally available to the external user.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 4.8,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "LOW",
                  integrityImpact: "LOW",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
                  version: "3.1",
               },
               format: "CVSS",
               scenarios: [
                  {
                     lang: "en",
                     value: "GENERAL",
                  },
               ],
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-20",
                     description: "CWE-20 Improper Input Validation",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-11-24T00:57:39.349Z",
            orgId: "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
            shortName: "php",
         },
         references: [
            {
               url: "https://github.com/php/php-src/security/advisories/GHSA-c5f2-jwm7-mmq2",
            },
         ],
         source: {
            advisory: "https://github.com/php/php-src/security/advisories/GHSA-c5f2-jwm",
            discovery: "EXTERNAL",
         },
         title: "Configuring a proxy in a stream context might allow for CRLF injection in URIs",
         x_generator: {
            engine: "Vulnogram 0.2.0",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
      assignerShortName: "php",
      cveId: "CVE-2024-11234",
      datePublished: "2024-11-24T00:57:39.349Z",
      dateReserved: "2024-11-15T06:26:08.361Z",
      dateUpdated: "2024-11-24T12:41:42.763Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
   "vulnerability-lookup:meta": {
      nvd: "{\"cve\":{\"id\":\"CVE-2024-11234\",\"sourceIdentifier\":\"security@php.net\",\"published\":\"2024-11-24T01:15:03.987\",\"lastModified\":\"2024-11-26T19:06:10.243\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, when using streams with configured proxy and \\\"request_fulluri\\\" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests originating from the server, thus potentially gaining access to resources not normally available to the external user.\"},{\"lang\":\"es\",\"value\":\"En las versiones de PHP 8.1.* anteriores a 8.1.31, 8.2.* anteriores a 8.2.26, 8.3.* anteriores a 8.3.14, cuando se utilizan flujos con proxy configurado y la opción \\\"request_fulluri\\\", la URI no se desinfecta correctamente, lo que puede provocar contrabando de solicitudes HTTP y permitir que el atacante use el proxy para realizar solicitudes HTTP arbitrarias que se originan en el servidor, obteniendo así potencialmente acceso a recursos que normalmente no están disponibles para el usuario externo.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@php.net\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N\",\"baseScore\":4.8,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.2,\"impactScore\":2.5},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":2.7}]},\"weaknesses\":[{\"source\":\"security@php.net\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-74\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.1.0\",\"versionEndExcluding\":\"8.1.31\",\"matchCriteriaId\":\"CE6E1B68-3EB9-4C67-97A6-226EA02CC2EA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.2.0\",\"versionEndExcluding\":\"8.2.26\",\"matchCriteriaId\":\"C160D91A-CF97-4DD1-A34F-8B8C852B3CEC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.3.0\",\"versionEndExcluding\":\"8.3.14\",\"matchCriteriaId\":\"35B1BA7F-0EAE-4F40-ACA4-EBC5D63F609A\"}]}]}],\"references\":[{\"url\":\"https://github.com/php/php-src/security/advisories/GHSA-c5f2-jwm7-mmq2\",\"source\":\"security@php.net\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]}]}}",
      vulnrichment: {
         containers: "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-11234\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-11-24T12:32:39.294616Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:php_group:php:*:*:*:*:*:*:*:*\"], \"vendor\": \"php_group\", \"product\": \"php\", \"versions\": [{\"status\": \"affected\", \"version\": \"8.1.0\", \"lessThan\": \"8.1.31\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"8.2.0\", \"lessThan\": \"8.2.26\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"8.3.0\", \"lessThan\": \"8.3.14\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:a:php_group:php:*:*:*:*:*:*:*:*\"], \"vendor\": \"php_group\", \"product\": \"php\", \"versions\": [{\"status\": \"affected\", \"version\": \"8.1.0\", \"lessThan\": \"8.1.31\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"8.2.0\", \"lessThan\": \"8.2.26\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"8.3.0\", \"lessThan\": \"8.3.14\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:a:php_group:php:*:*:*:*:*:*:*:*\"], \"vendor\": \"php_group\", \"product\": \"php\", \"versions\": [{\"status\": \"affected\", \"version\": \"8.1.0\", \"lessThan\": \"8.1.31\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"8.2.0\", \"lessThan\": \"8.2.26\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"8.3.0\", \"lessThan\": \"8.3.14\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-11-24T12:32:12.132Z\"}}], \"cna\": {\"title\": \"Configuring a proxy in a stream context might allow for CRLF injection in URIs\", \"source\": {\"advisory\": \"https://github.com/php/php-src/security/advisories/GHSA-c5f2-jwm\", \"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Lorenzo Leonardini\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 4.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"PHP Group\", \"product\": \"PHP\", \"versions\": [{\"status\": \"affected\", \"version\": \"8.1.*\", \"lessThan\": \"8.1.31\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"8.2.*\", \"lessThan\": \"8.2.26\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"8.3.*\", \"lessThan\": \"8.3.14\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2024-11-21T18:15:00.000Z\", \"references\": [{\"url\": \"https://github.com/php/php-src/security/advisories/GHSA-c5f2-jwm7-mmq2\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, when using streams with configured proxy and \\\"request_fulluri\\\" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests originating from the server, thus potentially gaining access to resources not normally available to the external user.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"<span style=\\\"background-color: rgb(255, 255, 255);\\\">In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, when using streams with configured proxy and \\\"request_fulluri\\\" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests originating from the server, thus potentially gaining access to resources not normally available to the external user.&nbsp;</span><br>\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-20\", \"description\": \"CWE-20 Improper Input Validation\"}]}], \"providerMetadata\": {\"orgId\": \"dd77f84a-d19a-4638-8c3d-a322d820ed2b\", \"shortName\": \"php\", \"dateUpdated\": \"2024-11-24T00:57:39.349Z\"}}}",
         cveMetadata: "{\"cveId\": \"CVE-2024-11234\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-11-24T12:41:42.763Z\", \"dateReserved\": \"2024-11-15T06:26:08.361Z\", \"assignerOrgId\": \"dd77f84a-d19a-4638-8c3d-a322d820ed2b\", \"datePublished\": \"2024-11-24T00:57:39.349Z\", \"assignerShortName\": \"php\"}",
         dataType: "CVE_RECORD",
         dataVersion: "5.1",
      },
   },
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.