PT-2022-20534 · Laminas · Laminas Diactoros

Maximilian Kresse · Published 2022-07-27 · Updated 2022-08-06 · CVE-2022-31109

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions laminas-diactoros versions prior to 2.11.1

Description The laminas-diactoros PHP package is vulnerable to potential host, protocol, and/or port modification of a LaminasDiactorosUri instance associated with the incoming server request, based on values from X-Forwarded-* headers. This can lead to XSS attacks or URL poisoning if a fully-qualified URL is used in links. The X-Forwarded-* headers have valid use cases, particularly in clustered environments using a load balancer.

Recommendations For versions prior to 2.11.1, users are advised to upgrade to version 2.11.1 or later to resolve this issue. For users unable to upgrade, configure web servers to reject X-Forwarded-* headers at the web server level. As a temporary workaround, consider using the LaminasDiactorosRequestFilterNoOpRequestFilter implementation to ignore the X-Forwarded-* headers. Starting in version 3.0, the library will reverse behavior to use the NoOpRequestFilter by default, and require users to opt-in to X-Forwarded-* header usage via a configured LaminasDiactorosRequestFilterLegacyXForwardedHeaderFilter instance.

Exploit

Fix

XSS

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-79

CWE-444

Related Identifiers

CVE-2022-31109

GHSA-8274-H5JP-97VR

Affected Products

Laminas Diactoros

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31109.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/laminas/laminas-diactoros/CVE-2022-31109.yaml · Exploit
• https://github.com/laminas/laminas-diactoros/commit/25b11d422c2e5dad868f68619888763b30f91e2d · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-31109 · Security Note
• https://osv.dev/vulnerability/GHSA-8274-h5jp-97vr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-31109 · Vendor Advisory
• https://github.com/laminas/laminas-diactoros/releases/tag/2.11.1 · Note
• https://github.com/laminas/laminas-diactoros/security/advisories/GHSA-8274-h5jp-97vr · Note
• https://github.com/laminas/laminas-diactoros · Note
• https://github.com/advisories/GHSA-8274-h5jp-97vr · Note
• https://t.me/cvenotify/34107 · Telegram Post
• https://t.me/cibsecurity/47358 · Telegram Post
• https://portswigger.net/web-security/host-header · Note