GHSA-v9m8-9xxp-q492 — Auth0-PHP SDK Deserialization of Untrusted Data vulnerability

The advisory, in context

Overview The Auth0 PHP SDK contains a vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data.

Am I Affected? You are affected by this vulnerability if you meet the following preconditions:

Applications using the Auth0-PHP SDK, versions between 8.0.0-BETA3 to 8.3.0.
Applications using the following SDKs that rely on the Auth0-PHP SDK versions between 8.0.0-BETA3 to 8.3.0: a. Auth0/symfony, b. Auth0/laravel-auth0, c. Auth0/wordpress.

Fix Upgrade Auth0/Auth0-PHP to 8.3.1.

Acknowledgement Okta would like to thank Andreas Forsblom for discovering this vulnerability.

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

auth0/auth0-php Packagist

Ecosystem versions

From 8.0.0-BETA3 before 8.3.1

Fixed in 8.3.1

12 explicitly affected versions

8.0.0, 8.0.0-BETA3, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.1.0, 8.2.0, 8.2.1, 8.3.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "8.0.0-BETA3"
        },
        {
          "fixed": "8.3.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "8.0.0",
    "8.0.0-BETA3",
    "8.0.1",
    "8.0.2",
    "8.0.3",
    "8.0.4",
    "8.0.5",
    "8.0.6",
    "8.1.0",
    "8.2.0",
    "8.2.1",
    "8.3.0"
  ]
}

Set up in your agent.

Investigate in your agent.

Auth0-PHP SDK Deserialization of Untrusted Data vulnerability

The advisory, in context

Affected packages

References