Fluid Attacks Database

Description

In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, when using streams with configured proxy and "request_fulluri" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests originating from the server, thus potentially gaining access to resources not normally available to the external user.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 12	php8.2	=8.2.10-1 \|\| =8.2.10-2 \|\| =8.2.12-1 \|\| =8.2.16-1 \|\| =8.2.16-2 \|\| =8.2.17-1 \|\| =8.2.18-1 \|\| =8.2.18-1~deb12u1 \|\| =8.2.20-1~deb12u1 \|\| =8.2.20-2 \|\| =8.2.20-3 \|\| =8.2.21-1 \|\| =8.2.23-1 \|\| =8.2.24-1 \|\| =8.2.24-1~deb12u1 \|\| =8.2.5-2 \|\| =8.2.7-1 \|\| =8.2.7-1.1 \|\| =8.2.7-1.2 \|\| =8.2.7-1~deb12u1 \|\| >=0 <8.2.26-1~deb12u1	8.2.26-1~deb12u1
rpm rhel8	php	<0:7.4.33-3.module+el8.10.0+23902+d3c8dd8f	0:7.4.33-3.module+el8.10.0+23902+d3c8dd8f
rpm rhel7	php	-	-
rpm rhel9	php	<0:8.0.30-2.el9	0:8.0.30-2.el9
packagist	php	>=8.1.0 <8.1.31 \|\| >=8.2.0 <8.2.26 \|\| >=8.3.0 <8.3.14	8.1.31, 8.2.26, 8.3.14

Aliases

1. CVE-2024-112342. NVD-2024-112343. OSV-DEBIAN-2024-112344. OSV-2024-112345. GCVE-2024-112346. SECURITY-TRACKER-CVE-2024-112347. lists.debian.org8. https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/11xxx/CVE-2024-11234.json9. GHSA-c5f2-jwm7-mmq210. security.netapp.com

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.