ZendFramework Route Parameter Injection Via Query String in `Zend\Mvc`
In Zend Framework 2, Zend\Mvc\Router\Http\Query is used primarily to allow appending query strings to URLs when assembled. However, due to the fact that it captures any query parameters into the RouteMatch, and the fact that RouteMatch parameters are merged with any parent routes, this can lead to overriding already captured routing parameters, bypassing constraints defined in the parents.
As an example, consider the following route definition:
array(
'user' => array(
'type' => 'segment',
'options' => array(
'route' => '/user/:key',
'defaults' => array(
'controller' => 'UserController',
'action' => 'show-action',
),
'constraints' => array(
'key' => '[a-z0-9]+',
),
),
'child_routes' => array(
'query' => array('type' => 'query'),
),
),
)If the request URI was /user/foo/?controller=SecretController&key=invalid_value, the RouteMatch returned after routing would contain the following:
array(
'controller' => 'SecretController',
'action' => 'show-action',
'key' => 'invalid_value',
)This would lead to execution of a different controller than intended, with a value for the key parameter that bypassed the constraints outlined in the parent route.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Paquete de Composer | zendframework/zendframework | >= 2.0.0, < 2.0.8, >= 2.1.0, < 2.1.4 | 2.0.8, 2.1.4 |
Referencias
- https://github.com/zendframework/zendframework/commit/0a7ec3407f02db29ea2ffd6daa71ead6fd151cfe
- https://github.com/zendframework/zendframework/commit/7fcb88ebc2d56f74aa943909f2b6b53f5c86b081
- https://framework.zend.com/security/advisory/ZF2013-01
- https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework/ZF2013-01.yaml
- https://github.com/zendframework/zendframework
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N- Debilidad (CWE)
CWE-74- Plataforma
- Composer
- Paquete
zendframework/zendframework- Publicada
- 07.06.2024
- Actualizado
- 11.10.2026 10:22
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-jq87-2wxp-8349 - CC BY 4.0
Historial de vulnerabilidades: zendframework/zendframework
Todas las vulnerabilidades publicadas de este paquete (Paquete de Composer), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 23
- Primera → última
- 06.2021 06.2024
- Sin corrección
- 1
- Explotada en ataques
- 0
Distribución por gravedad
- Crítica 6
- Alta 7
- Media 10
Divulgaciones por año
- 2021: 1
- 2022: 9
- 2023: 0
- 2024: 13
- 2025: 0
- 2026: 0
-
ZendFramework Route Parameter Injection Via Query String in `Zend\Mvc` esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.