PT-2022-19495 · Guzzle · Guzzle

Dezső Biczó + 1 · Published 2022-05-25 · Updated 2024-03-06 · CVE-2022-29248

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Guzzle versions prior to 6.5.6 and 7.4.3

Description The issue is related to the cookie middleware in Guzzle, a PHP HTTP client. It does not check if the cookie domain equals the domain of the server that sets the cookie via the Set-Cookie header, allowing a malicious server to set cookies for unrelated domains. This affects users who manually add the cookie middleware to the handler stack or construct the client with ['cookies' => true]. Users who do not use the same Guzzle client to call multiple domains and have disabled redirect forwarding are not affected.

Recommendations For versions prior to 6.5.6, upgrade to version 6.5.6. For versions prior to 7.4.3, upgrade to version 7.4.3. As a temporary workaround, consider turning off the cookie middleware.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

CWE-565

Related Identifiers

BIT-DRUPAL-2022-29248

CVE-2022-29248

DRUPAL-CORE-2022-010

DSA-5246-1

GHSA-CWMX-HCRQ-MHC3

MGASA-2022-0338

Affected Products

Guzzle

References · 30

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29248.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/guzzlehttp/guzzle/CVE-2022-29248.yaml · Exploit
• https://github.com/guzzle/guzzle/pull/3018 · Patch
• https://github.com/guzzle/guzzle/commit/74a8602c6faec9ef74b7a9391ac82c5e65b1cdab · Patch
• https://debian.org/security/2022/dsa-5246 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5246-1 · Vendor Advisory
• https://drupal.org/sa-core-2022-010 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-29248 · Security Note
• https://osv.dev/vulnerability/MGASA-2022-0338 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-29248 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-29248 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cwmx-hcrq-mhc3 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-29248 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-29248 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-29248 · Security Note