PT-2019-5066 · Php · Pharstreamwrapper

Daniel Le Gall · Published 2019-05-08 · Updated 2021-10-01 · CVE-2019-11831

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PharStreamWrapper package versions 2.x before 2.1.1 PharStreamWrapper package versions 3.x before 3.1.1

Description The issue is related to the PharStreamWrapper package, which does not prevent directory traversal. This allows attackers to bypass a deserialization protection mechanism. The vulnerability can be exploited by using a URL such as "phar:///path/bad.phar/../good.phar" to bypass protection. The vulnerability is associated with incorrect limitation of the path name to a directory with limited access, which can allow an attacker to disclose protected information.

Recommendations For PharStreamWrapper package versions 2.x before 2.1.1, update to version 2.1.1 or later. For PharStreamWrapper package versions 3.x before 3.1.1, update to version 3.1.1 or later. As a temporary workaround, consider restricting access to the phar:/// protocol handler until a patch is available. Avoid using URLs that contain the ../ sequence in the path, as they can be used to exploit the vulnerability.

Exploit

Fix

Deserialization of Untrusted Data

Path traversal

Weakness Enumeration

CWE-502

CWE-22

Related Identifiers

BDU:2020-01708

CVE-2019-11831

DLA-1797-1

DRUPAL-CORE-2019-007

DSA-4445-1

GHSA-XV7V-RF6G-XWRC

Affected Products

Pharstreamwrapper

References · 40

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2019-11831.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/phar-stream-wrapper/CVE-2019-11831.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2019-11831.yaml · Exploit
• https://debian.org/security/2019/dsa-4445 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z246UWBXBEKTQUDTLRJTC7XYBIO4IBE4 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4445-1 · Vendor Advisory
• https://typo3.org/security/advisory/typo3-psa-2019-007 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E3NUKPG7V4QEM6QXRMHYR4ABFMW5MM2P · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11831 · Security Note
• https://bdu.fstec.ru/vul/2020-01708 · Security Note
• https://ubuntu.com/security/CVE-2019-11831 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/E3NUKPG7V4QEM6QXRMHYR4ABFMW5MM2P · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/U6JX7WR6DPMKCZQP7EYFACYXSGJ3K523 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AUEXS4HRI4XZ2DTZMWAVQBYBTFSJ34AR · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/6QDJVUJPUW3RZ4746SC6BX4F4T6ZXNBH · Vendor Advisory