CVE-2020-15148: Unsafe deserialization in Yii 2
Impact
Remote code execution in case application calls unserialize() on user input containing specially crafted string.
Patches
2.0.38
Workarounds
Add the following to BatchQueryResult.php:
php public function sleep() { throw new \BadMethodCallException('Cannot serialize '.CLASS); }
public function wakeup() { throw new \BadMethodCallException('Cannot unserialize '.CLASS); }
For more information
If you have any questions or comments about this advisory, contact us through security form.
Other sources
Possible remote code execution via unserialize() on user input containing specially crafted string
Yii 2 (yiisoft/yii2) before version 2.0.38 is vulnerable to remote code execution if the application calls unserialize() on arbitrary user input. This is fixed in version 2.0.38. A possible workaround without upgrading is available in the linked advisory.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID is CVE-2020-15148.
What is the severity of CVE-2020-15148?
The severity of CVE-2020-15148 is critical.
What is the affected software of CVE-2020-15148?
The affected software of CVE-2020-15148 is Yii 2 (yiisoft/yii2) before version 2.0.38.
How does CVE-2020-15148 work?
CVE-2020-15148 allows remote code execution by calling `unserialize()` on arbitrary user input.
How can I fix CVE-2020-15148?
To fix CVE-2020-15148, upgrade to version 2.0.38 of Yii 2 (yiisoft/yii2) or apply the suggested workaround in the linked advisory.