GHSA-xffp-6w68-4775 Zendframework Remote Address Spoofing Vector in `Zend\Http\PhpEnvironment\RemoteAddress`
Attackers can spoof IP addresses by bypassing trusted proxy checks in Zend Framework, potentially evading IP-based security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-xffp-6w68-4775?
GHSA-xffp-6w68-4775 is a vulnerability in zendframework/zendframework, published on 7 Jun 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Zend\Http\PhpEnvironment\RemoteAddress class provides features around detecting the internet protocol (IP) address for an incoming proxied request via the X-Forwarded-For header, taking into account a provided list of trusted proxy server IPs. Prior to 2.2.5, the class was not taking into account whether or not the IP address contained in PHP's $_SERVER['REMOTE_ADDR'] was in the trusted proxy server list.
The IETF draft specification indicates that if $_SERVER['REMOTE_ADDR'] is not a trusted proxy, it must be considered the originating IP address, and the value of X-Forwarded-For must be disregarded.
Which versions are affected by GHSA-xffp-6w68-4775?
2 open source packages ship an affected version, including zendframework/zendframework.
| Package | Affected | Fixed in |
|---|---|---|
zendframework/zendframework Packagist | From 2.2.0 | 2.2.5 |
zendframework/zendframework Packagist | From 2.2.0 | 2.2.5 |
How do I fix GHSA-xffp-6w68-4775?
Upgrade zendframework/zendframework to 2.2.5 or later.
Is GHSA-xffp-6w68-4775 being exploited?
There is no known exploitation of GHSA-xffp-6w68-4775 in the wild and no public exploit code.