PT-2009-6310 · Zend+2 · Zend Framework+2

Stefan Esser · Published 2009-12-24 · Updated 2019-11-21 · CVE-2009-4137

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Piwik versions prior to 0.5

Description The issue concerns the loadContentFromCookie function in Piwik's core/Cookie.php, which fails to validate strings from cookies before unserializing them. This allows remote attackers to execute arbitrary code or upload files via various vectors, including the destruct function in the Piwik Config class, php://filter URIs, and the destruct and shutdown functions in Zend Framework. Additionally, it affects the render function in the Piwik View class, Smarty templates, and the eval function in Smarty.

Recommendations For versions prior to 0.5, update to version 0.5 or later to resolve the issue. As a temporary workaround, consider disabling the loadContentFromCookie function until a patch is available. Restrict access to the Piwik Config class and the render function in the Piwik View class to minimize the risk of exploitation. Avoid using the destruct and shutdown functions in Zend Framework in the affected versions until the issue is resolved.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2009-4137

Affected Products

Piwik

Smarty

Zend Framework

References · 11

• 🔥 https://github.com/Alexeyan/CVE-2009-4137 · Exploit
• http://dev.piwik.org/trac/changeset/1637 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-4137 · Security Note
• http://piwik.org/blog/2009/12/piwik-response-to-shocking-news-in-php-exploitation · Vendor Advisory
• http://sektioneins.de/en/advisories/advisory-032009-piwik-cookie-unserialize-vulnerability · Note
• http://openwall.com/lists/oss-security/2009/12/14/2 · Note
• http://openwall.com/lists/oss-security/2009/12/10/1 · Note
• http://suspekt.org/downloads/POC2009-ShockingNewsInPHPExploitation.pdf · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4137 · Note
• http://suspekt.org/2009/12/09/advisory-032009-piwik-cookie-unserialize-vulnerability · Note
• http://openwall.com/lists/oss-security/2009/12/09/2 · Note