CVE-2024-11234: Configuring a proxy in a stream context might allow for CRLF injection in URIs
Configuring a proxy in a stream context might allow for CRLF injection in URIs
Other sources
In PHP versions 8.1. before 8.1.31, 8.2. before 8.2.26, 8.3. before 8.3.14, when using streams with configured proxy and "requestfulluri" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests originating from the server, thus potentially gaining access to resources not normally available to the external user.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.1.31 - Upgrade
Upgrade
debian/php7.4to a version that resolves this vulnerability.Fixed in 7.4.33-1+deb11u8 - Upgrade
Upgrade
debian/php8.2to a version that resolves this vulnerability.Fixed in 8.2.26-1~deb12u1Fixed in 8.2.28-1~deb12u1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.1.31-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.3.14-1 - Upgrade
Upgrade
phpto a version that resolves this vulnerability.Fixed in 8.1.31 - Upgrade
Upgrade
phpto a version that resolves this vulnerability.Fixed in 8.2.26 - Upgrade
Upgrade
phpto a version that resolves this vulnerability.Fixed in 8.3.14
Event History
Frequently Asked Questions
What is the severity of CVE-2024-11234?
CVE-2024-11234 has been classified as a medium severity vulnerability due to the potential for CRLF injection in URIs.
How do I fix CVE-2024-11234?
To fix CVE-2024-11234, upgrade PHP to version 8.1.31 or higher, or to versions 8.2.26 or higher, or 8.3.14 or higher.
Which PHP versions are affected by CVE-2024-11234?
CVE-2024-11234 affects PHP versions 8.1.0 to 8.1.30, 8.2.0 to 8.2.25, and 8.3.0 to 8.3.13.
What type of attack is possible with CVE-2024-11234?
This vulnerability allows for CRLF injection attacks which can lead to HTTP response splitting.
Is there a workaround for CVE-2024-11234?
There are no known workarounds for CVE-2024-11234; upgrading to a patched version is recommended.