CVE-2018-5712: XSS
A flaw was found in php when creating a .phar file and configuring apache to handle phar files using php, when accessing invalid page the page name is reflected back to the user in the 404 response. This user input is not being sanitized and therefore it is vulnerable to a reflected XSS. Making, every site configured to run .phar files using php vulnerable.
References: https://bugs.php.net/bug.php?id=74782 https://bugs.php.net/bug.php?id=74782
Patch: https://gist.github.com/anonymous/70d2f6bac8db576d6386bd79c1e6e081
Other sources
An issue was discovered in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1 ...
— Debian
Fixed bug (fix for CVE-2018-5712 may not be complete). (CVE-2018-10547)
— PHP
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 0:5.4.16-48.el7 - Upgrade
Upgrade
redhat/rh-php70-phpto a version that resolves this vulnerability.Fixed in 0:7.0.27-1.el6 - Upgrade
Upgrade
redhat/rh-php70-phpto a version that resolves this vulnerability.Fixed in 0:7.0.27-1.el7 - Upgrade
Upgrade
redhat/rh-php71-phpto a version that resolves this vulnerability.Fixed in 0:7.1.30-1.el7 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 7.0.27 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 7.1.13 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 7.2.1 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 7.0.30 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.6.33 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.0.27 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.1.13 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.2.1 - Compensating control
For Apache sites configured to run .phar files using PHP, restrict or block HTTP requests for non-existent/invalid .phar paths at the web server (e.g., via routing rules or access controls) to prevent exposure of the PHAR 404 response that reflects the requested .phar URI parameter.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2018-5712?
CVE-2018-5712 is a vulnerability that allows for reflected XSS on the PHAR 404 error page in PHP.
What is the severity of CVE-2018-5712?
The severity of CVE-2018-5712 is medium with a CVSS score of 6.1.
Which versions of PHP are affected by CVE-2018-5712?
Versions before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1 are affected by CVE-2018-5712.
How can I fix CVE-2018-5712?
To fix CVE-2018-5712, update your PHP version to 5.6.33 or above, 7.0.27 or above, 7.1.13 or above, or 7.2.1 or above.
Where can I find more information about CVE-2018-5712?
You can find more information about CVE-2018-5712 in the following references: [1] [2] [3].