ZendFramework Potential Proxy Injection Vulnerabilities
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub.
Summary
`Zend\Session\Validator\RemoteAddr` and `Zend\View\Helper\ServerUrl` were found to be improperly parsing HTTP headers for proxy information, which could potentially allow an attacker to spoof a proxied IP or host name. In `Zend\Session\Validator\RemoteAddr`, if the client is behind a proxy server, the detection of the proxy URL was incorrect, and could lead to invalid results on subsequent lookups. In `Zend\View\Helper\ServerUrl`, if the server lives behind a proxy, the helper would always generate a URL based on the proxy host, regardless of whether or not this was desired; additionally, it did not take into account the proxy port or protocol, if provided.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | zendframework/zendframework (Packagist) | 2.0.0 to before 2.0.5 | 2.0.5 | Patch available | GHSA-mg7h-9qfx-4r83 |
- zendframework/zendframework (Packagist) Vendor— Affected 2.0.0 to before 2.0.5 Fixed in 2.0.5 Patch available GHSA-mg7h-9qfx-4r83
Remediation
- Fix · GHSA-mg7h-9qfx-4r83 zendframework/zendframework (Packagist) Fixed in 2.0.5 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-mg7h-9qfx-4r83
References
Other 9
- https://github.com/zendframework/zendframework/commit/1040acaf70d297ec7214934d8ddc3e811d249b5c
- https://github.com/zendframework/zendframework/commit/ad8fdc3378710b7cfbe2a271dbb0e3256cffb599
- https://github.com/zendframework/zendframework/commit/ada1fab92f6d5c7ad96c5a63f3196d925e3f5887
- https://github.com/zendframework/zendframework/commit/b914ecdd4d17ab5b61f15ccdc02a6e9b255b15d8
- https://github.com/zendframework/zendframework/commit/c3819abbf2c9571069c893d27ae6170bda413925
- https://github.com/zendframework/zendframework/commit/cfaf5ea095c93f3e70343358a3a88c3924d7ed7d
- https://framework.zend.com/security/advisory/ZF2012-04
- https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework/ZF2012-04.yaml
- https://github.com/zendframework/zendframework
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences