mezzio-swoole Applications Using Diactoros Vulnerable to HTTP Host Header Attack
The advisory, in context
Impact
mezzio-swoole applications using Diactoros for their PSR-7 implementation, and which are either not behind a proxy, or can be accessed via untrusted proxies, can potentially have the host, protocol, and/or port of a Laminas\Diactoros\Uri instance associated with the incoming server request modified to reflect values from X-Forwarded-* headers. Such changes can potentially lead to XSS attacks (if a fully-qualified URL is used in links) and/or URL poisoning.
Patches
3.7.0, and 4.3.0 and later.
The patches present in these versions update the SwooleServerRequestFactory to filter out X-Forwarded-* headers when creating the initial request. They then by default pass that instance through a Laminas\Diactoros\ServerRequestFilter\FilterUsingXForwardedHeaders instance created from the trustReservedSubnet() constructor, ensuring that the request only honors the X-Forwarded-* headers for private reserved subnets.
Users can define the Laminas\Diactoros\ServerRequestFilter\FilterServerRequestInterface service if they wish to provide a different implementation, or configure the FilterUsingXForwardedHeaders instance differently. When defined, that instance will be used to filter the generated request instance.
Workarounds
Infrastructure or DevOps can place a trusted reverse proxy in front of the mezzio-swoole server.
References
For more information
If you have any questions or comments about this advisory:
- Open an issue in mezzio/mezzio-swoole
- Email us
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
Earlier releases before 3.7.0
Fixed in 3.7.0
42 explicitly affected versions
0.1.0, 0.1.1, 0.2.0, 0.2.1, 0.2.2, 0.2.3, 0.2.4, 1.0.0, 1.0.1, 1.0.2, 2.0.0, 2.0.1, 2.1.0, 2.2.0, 2.2.1, 2.3.0, 2.4.0, 2.4.1, 2.5.0, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 2.7.0, 2.8.0, 2.8.1, 3.0.0, 3.0.1, 3.1.0, 3.1.1, 3.1.2, 3.2.0, 3.2.1, 3.3.0, 3.3.1, 3.4.0, 3.5.0, 3.5.1, 3.6.0
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.7.0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.1.0",
"0.1.1",
"0.2.0",
"0.2.1",
"0.2.2",
"0.2.3",
"0.2.4",
"1.0.0",
"1.0.1",
"1.0.2",
"2.0.0",
"2.0.1",
"2.1.0",
"2.2.0",
"2.2.1",
"2.3.0",
"2.4.0",
"2.4.1",
"2.5.0",
"2.6.0",
"2.6.1",
"2.6.2",
"2.6.3",
"2.6.4",
"2.6.5",
"2.6.6",
"2.7.0",
"2.8.0",
"2.8.1",
"3.0.0",
"3.0.1",
"3.1.0",
"3.1.1",
"3.1.2",
"3.2.0",
"3.2.1",
"3.3.0",
"3.3.1",
"3.4.0",
"3.5.0",
"3.5.1",
"3.6.0"
]
}From 4.0.0 before 4.3.0
Fixed in 4.3.0
4 explicitly affected versions
4.0.0, 4.1.0, 4.1.1, 4.2.0
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.3.0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4.0.0",
"4.1.0",
"4.1.1",
"4.2.0"
]
}