GHSA-2w9p-xxqr-h253 eZ Platform Object Injection in SiteAccessMatchListener
An object injection vulnerability in eZ Platform allows remote attackers to execute arbitrary code without authentication.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-2w9p-xxqr-h253?
GHSA-2w9p-xxqr-h253 is an unsafe deserialization vulnerability in ezsystems/ezplatform-kernel, published on 15 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
This Security Advisory is about an object injection vulnerability in the SiteAccessMatchListener of eZ Platform, which could lead to remote code execution (RCE), a very serious threat. All sites may be affected.
Update: There are bugs introduced by this fix, particularly but not limited to compound siteaccess matchers. These have been fixed in ezsystems/ezplatform-kernel v1.0.3, and in ezsystems/ezpublish-kernel v7.5.8, v6.13.6.4, and v5.4.15.
Which versions are affected by GHSA-2w9p-xxqr-h253?
2 open source packages ship an affected version, including ezsystems/ezplatform-kernel.
| Package | Affected | Fixed in |
|---|---|---|
ezsystems/ezplatform-kernel Packagist | From 1.0.0 | 1.0.3 |
ezsystems/ezplatform-kernel Packagist | From 1.0.0 | 1.0.3 |
How do I fix GHSA-2w9p-xxqr-h253?
Upgrade ezsystems/ezplatform-kernel to 1.0.3 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is GHSA-2w9p-xxqr-h253 being exploited?
There is no known exploitation of GHSA-2w9p-xxqr-h253 in the wild and no public exploit code.