PT-2021-18593 · Laminas+1 · Laminas Project Laminas-Http+1

Weierophinney · Published 2021-01-04 · Updated 2024-08-03 · CVE-2021-3007

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Laminas Project laminas-http versions prior to 2.14.2 Zend Framework version 3.0.0

Description The issue is related to a deserialization vulnerability that can lead to remote code execution if the content is controllable. This is due to the destruct method of the ZendHttpResponseStream class in Stream.php. The laminas-http vendor considers this a vulnerability in the PHP language itself but has added certain type checking as a way to prevent exploitation in use cases where attacker-supplied data can be deserialized. Zend Framework is no longer supported by the maintainer.

Recommendations For Laminas Project laminas-http versions prior to 2.14.2, update to version 2.14.2 or later to resolve the issue. For Zend Framework version 3.0.0, there is no official fix available since the framework is no longer supported by the maintainer. As a temporary workaround, consider disabling the destruct method of the ZendHttpResponseStream class until an alternative solution is found. At the moment, there is no information about a newer version that contains a fix for this vulnerability in Zend Framework.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2021-3007

GHSA-XX8F-QF9F-5FGW

Affected Products

Laminas Project Laminas-Http

Zend Framework

References · 16

• 🔥 https://github.com/Ling-Yizhou/zendframework3-/blob/main/zend%20framework3%20%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%20rce.md · Exploit
• 🔥 https://github.com/Vulnmachines/ZF3_CVE-2021-3007 · Exploit
• 🔥 https://research.checkpoint.com/2021/freakout-leveraging-newest-vulnerabilities-for-creating-a-botnet · Exploit
• https://github.com/laminas/laminas-http/commits/2.15.x/src/Response/Stream.php · Patch
• https://github.com/laminas/laminas-http/pull/48 · Patch
• https://osv.dev/vulnerability/CVE-2021-3007 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3007 · Security Note
• https://osv.dev/vulnerability/GHSA-xx8f-qf9f-5fgw · Vendor Advisory
• https://github.com/laminas/laminas-http/releases/tag/2.14.2 · Note
• https://github.com/laminas/laminas-http · Note
• https://t.me/cybersecuritytechnologies/2432 · Telegram Post
• https://t.me/cibsecurity/21520 · Telegram Post
• https://t.me/cvenotify/8699 · Telegram Post
• https://t.me/cvenotify/88807 · Telegram Post
• https://t.me/ckure/6603 · Telegram Post