GHSA-96c6-m98x-hxjx Zend-Session session validation vulnerability
Attackers can bypass session validation checks like IP or User-Agent, potentially hijacking sessions or evading detection in applications using Zend-Session.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-96c6-m98x-hxjx?
GHSA-96c6-m98x-hxjx is an authentication bypass vulnerability in zendframework/zend-session, published on 7 Jun 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Zend\Session session validators do not work as expected if set prior to the start of a session.
For instance, the following test case fails (where $this->manager is an instance of Zend\Session\SessionManager):
$this
->manager
->getValidatorChain()
->attach('session.validate', array(new RemoteAddr(), 'isValid'));
$this->manager->start();
$this->assertSame(
array(
'Zend\Session\Validator\RemoteAddr' =3D> '',
),
$_SESSION['__ZF']['_VALID']
);
The implication is that subsequent calls to Zend\Session\SessionManager#start() (in later requests, assuming a session was created) will not have any validator metadata attached, which causes any validator metadata to be re-built from scratch, thus marking the session as valid.
An attacker is thus able to simply ignore session validators such as RemoteAddr or HttpUserAgent, since the "signature" that these validators check against is not being stored in the session.
Which versions are affected by GHSA-96c6-m98x-hxjx?
4 open source packages ship an affected version, including zendframework/zend-session.
| Package | Affected | Fixed in |
|---|---|---|
zendframework/zend-session Packagist | From 2.0.0 | 2.2.9 |
zendframework/zend-session Packagist | From 2.0.0 | 2.2.9 |
zendframework/zend-session Packagist | From 2.3.0 | 2.3.4 |
zendframework/zend-session Packagist | From 2.3.0 | 2.3.4 |
How do I fix GHSA-96c6-m98x-hxjx?
Upgrade zendframework/zend-session to a fixed version for your release line: 2.2.9 or 2.3.4.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is GHSA-96c6-m98x-hxjx being exploited?
There is no known exploitation of GHSA-96c6-m98x-hxjx in the wild and no public exploit code.