SB2022022608 - Multiple vulnerabilities in CodeIgniter4

Description

This security bulletin contains information about 2 vulnerabilities.

1) Cross-site request forgery (CVE-ID: CVE-2022-24712)

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to bypass cross-site request forgery protection.

The vulnerability exists due to cross-site request forgery protection bypass in the csrf protection mechanism when handling crafted cross-site requests. A remote user can induce the victim's browser to send a crafted request to bypass cross-site request forgery protection.

User interaction is required.

2) Input validation error (CVE-ID: CVE-2022-24711)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

The vulnerability allows a remote attacker to execute CLI routes via HTTP requests.

The vulnerability exists due to improper input validation in HTTP request handling for CLI routes when processing HTTP requests. A remote attacker can send a specially crafted request to execute CLI routes via HTTP requests.

Remediation

Install update from vendor's website.

References

• https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-4v37-24gm-h554
• https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-5hm8-vh6r-2cjq
• https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-xjp4-6w75-qrj7
• https://github.com/codeigniter4/CodeIgniter4/security/advisories