PT-2024-40527 · Zend · Zendhttpphpenvironmentremoteaddress

Published 2024-06-07 · Updated 2024-06-07

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: ZendHttpPhpEnvironmentRemoteAddress versions prior to 2.2.5

Description: The issue concerns the detection of the internet protocol (IP) address for an incoming proxied request via the X-Forwarded-For header. The class did not properly consider whether the IP address in PHP's $ SERVER['REMOTE ADDR'] was in the list of trusted proxy server IPs. According to the IETF draft specification, if $ SERVER['REMOTE ADDR'] is not a trusted proxy, it should be considered the originating IP address, and the X-Forwarded-For value should be disregarded.

Recommendations: For versions prior to 2.2.5, update to version 2.2.5 or later to resolve the issue.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

GHSA-XFFP-6W68-4775

Affected Products

Zendhttpphpenvironmentremoteaddress

References · 5

• https://osv.dev/vulnerability/GHSA-xffp-6w68-4775 · Vendor Advisory
• https://github.com/zendframework/zendframework/commit/bb6784461d3b23ef1db4be8cf47957ccc3b681ed · Note
• https://github.com/zendframework/zendframework · Note
• https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework/ZF2013-04.yaml · Note
• https://framework.zend.com/security/advisory/ZF2013-04 · Note