logo

Database

Insecure deserialization In codeigniter/framework

Description

CodeIgniter and Kohana vulnerable to PHP Object Injection CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof session cookies and consequently conduct PHP object injection attacks by leveraging use of standard string comparison operators to compare cryptographic hashes.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2014-86842. NVD-2014-86843. OSV-2014-86844. GCVE-2014-8684

References

1. https://github.com/kohana/core/pull/4922. https://github.com/kohana/core/commit/66b409a6da2960130888989534ff1799532b8f323. https://github.com/bcit-ci/CodeIgniter/blob/2.2.6/system/libraries/Session.php#L1594. https://web.archive.org/web/20140802041151/https://scott.arciszewski.me/research/full/php-framework-timing-attacks-object-injection5. http://packetstormsecurity.com/files/130609/Seagate-Business-NAS-Unauthenticated-Remote-Command-Execution.html6. http://seclists.org/fulldisclosure/2014/May/547. https://www.exploit-db.com/exploits/362648. https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/seagate_nas_php_exec_noauth.rb

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.