CVE-2021-21707 Special characters break path parsing in XML functions
Attackers can bypass filename restrictions in PHP XML functions by using URL-encoded NUL characters to read unintended files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-21707?
CVE-2021-21707 is a medium-severity path traversal vulnerability in Debian Debian Linux, published on 29 Nov 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexml_load_file(), URL-decode the filename passed to them. If that filename contains URL-encoded NUL character, this may cause the function to interpret this as the end of the filename, thus interpreting the filename differently from what the user intended, which may lead it to reading a different file than intended.
Weakness: CWE-159
Which versions are affected by CVE-2021-21707?
3 open source packages ship an affected version, including libphp, php and php-min. It affects 4 products.
| Package | Affected | Fixed in |
|---|---|---|
libphp Bitnami | From 7.3.0 | 7.3.33, 7.4.26, 8.0.13 |
php Bitnami | From 7.3.0 | 7.3.33, 7.4.26, 8.0.13 |
php-min Bitnami | From 7.3.0 | 7.3.33, 7.4.26, 8.0.13 |
Linux distribution packages (4)
php74 SUSE:Linux Enterprise Module for Web and Scripting 12 | All versions | 7.4.6-1.30.1 |
php74 SUSE:Linux Enterprise Software Development Kit 12 SP5 | All versions | 7.4.6-1.30.1 |
php7 openSUSE:Tumbleweed | All versions | 7.4.26-1.1 |
php8 openSUSE:Tumbleweed | All versions | 8.0.13-1.1 |
Products include Debian Debian Linux, Netapp Clustered Data Ontap, Php Php, Tenable Tenable.sc.
How do I fix CVE-2021-21707?
Upgrade libphp to a fixed version for your release line: 7.3.33, 7.4.26 or 8.0.13.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2021-21707 being exploited?
There is no known exploitation of CVE-2021-21707 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as BIT-libphp-2021-21707, BIT-php-2021-21707, BIT-php-min-2021-21707, DEBIAN-CVE-2021-21707, ECHO-5db2-f6f6-1773, GHSA-qh78-qfw9-93x9 and 6 more.