critical9.8Public exploit code
CVE-2014-8684
CodeIgniter and Kohana vulnerable to PHP Object Injection
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Seagate Business NAS - Remote Command Execution (Metasploit)2015-03-04 · remote · php · Verified
Impact
CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof session cookies and consequently conduct PHP object injection attacks by leveraging use of standard string comparison operators to compare cryptographic hashes.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | codeigniter/framework | < 3.0.0 | 3.0.0 |
| composer | kohana/core | < 3.3.3 | 3.3.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Codeigniter | Codeigniter | through 2.2.6 |
| Kohanaframework | Kohana | Versions 3.2.3, 3.3.0, 3.3.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://packetstormsecurity.com/files/130609/Seagate-Business-NAS-Unauthenticated-Remote-Command-Execution.html
- http://seclists.org/fulldisclosure/2014/May/54
- https://github.com/kohana/core/pull/492
- https://scott.arciszewski.me/research/full/php-framework-timing-attacks-object-injection
- https://github.com/advisories/GHSA-w9ph-q4h9-rwq6
- https://nvd.nist.gov/vuln/detail/CVE-2014-8684
- https://github.com/kohana/core/commit/66b409a6da2960130888989534ff1799532b8f32
- https://github.com/bcit-ci/CodeIgniter/blob/2.2.6/system/libraries/Session.php#L159
- https://web.archive.org/web/20140802041151/https://scott.arciszewski.me/research/full/php-framework-timing-attacks-object-injection