ZendFramework local file inclusion vector in `Zend_View::setScriptPath()` and `render()`
The advisory, in context
Zend_View is a component that utilizes PHP as a templating language. To utilize it, you specify "script paths" that contain view scripts, and then render() view scripts by specifying subdirectories within those script paths; the output is then returned as a string value which may be cached or directly output.
Zend_View::setScriptPath() in versions up to and including 1.7.4 include a potential Local File Inclusion vulnerability. If untrusted input is used to specify the script path and/or view script itself, a malicious attacker could potentially specify a system directory and thus render a system file.
As an example, if the user-supplied string /etc/passwd or a relative path that resolved to that file, was supplied to Zend_View::render(), that file would be rendered.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
From 1.7.0 before 1.7.5
Fixed in 1.7.5
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "1.7.0"
},
{
"fixed": "1.7.5"
}
],
"type": "ECOSYSTEM"
}
],
"versions": []
}