An untrusted deserialization vulnerability in the Zend Framework was disclosed this week. If exploited by attackers, they can achieve Remote Code Execution (RCE) on PHP Sites.
This vulnerability could impact some instances of the Laminas project, which is Zend’s successor. Zend Framework is built from PHP packages and used by developers to build object-orientated web applications.
The vulnerability stems from the destructor of the Stream class in the PHP code within the Framework. In object-orientated programming, constructors and destructors are methods that are called when a new class is created or disposed of.
If an attacker can achieve remote code execution by gaining control over the values returned in the serialization process, then they can execute arbitrary commands and could potentially seize control of the web application itself.
The resulting damages can be, loss of revenue and more importantly reputation.
Zend Framework is no longer supported by the vendor and, it is recommended to upgrade to the latest version of the Laminas project. The latest version (dated from this article 05.01.2021) is version 3.0, the components and documentation are located here.
Source: Bleeping Computer
Introducing ISO 42001 – the world’s first international management system standard focused specifically on AI.…
Data breaches and cyberattacks have become daily concerns for information security professionals and business leaders.…
It is an undeniable fact that all applications and infrastructures are essentially in need of…
