CVE-2023-3823
Security issue with external entity loading in XML without enabling it
Published Aug 11, 2023
CVSS 3.1 · 8.6 High
EPSS 1.6%
KEV · Not listed
Description
In PHP versions 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8 various XML functions rely on libxml global state to track configuration variables, like whether external entities are loaded. This state is assumed to be unchanged unless the user explicitly changes it by calling appropriate function. However, since the state is process-global, other modules - such as ImageMagick - may also use this library within the same process, and change that global state for their internal purposes, and leave it in a state where external entities loading is enabled. This can lead to the situation where external XML is parsed with external entities loaded, which can lead to disclosure of any local files accessible to PHP. This vulnerable state may persist in the same process across many requests, until the process is shut down.
Affected Products
-
CVE record
-
NVD configurations
-
Red Hat packages
-
OpenCVE enrichment
No data
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| PHP Group | PHP | affected |
|
Configuration 1 [-]
|
Configuration 2 [-]
|
Configuration 3 [-]
|
| Package | CPE | Advisory | Released Date |
|---|---|---|---|
| Red Hat Enterprise Linux 8 | |||
| php:8.0-8080020231006102311.0b4eb31d | cpe:/a:redhat:enterprise_linux:8 | RHSA-2023:5927 | 2023-10-19T00:00:00Z |
| php:7.4-8100020241113075828.f7998665 | cpe:/a:redhat:enterprise_linux:8 | RHSA-2024:10952 | 2024-12-11T00:00:00Z |
| Red Hat Enterprise Linux 9 | |||
| php-0:8.0.30-1.el9_2 | cpe:/a:redhat:enterprise_linux:9 | RHSA-2023:5926 | 2023-10-19T00:00:00Z |
| php:8.1-9030020231221080340.9 | cpe:/a:redhat:enterprise_linux:9 | RHSA-2024:0387 | 2024-01-24T00:00:00Z |
No data available yet.
Remediation
Vendor Workaround
Disable external entity loader, e.g. like this: libxml_set_external_entity_loader(function () { return null; });
Tracking
Advisories
| Source | ID | Title |
|---|---|---|
 Debian DLA |
DLA-3555-1 | php7.3 security update |
 Debian DSA |
DSA-5660-1 | php7.4 security update |
| Debian DSA |
DSA-5661-1 | php8.2 security update |
 EUVD |
EUVD-2023-44451 | In PHP versions 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8 various XML functions rely on libxml global state to track configuration variables, like whether external entities are loaded. This state is assumed to be unchanged unless the user explicitly changes it by calling appropriate function. However, since the state is process-global, other modules - such as ImageMagick - may also use this library within the same process, and change that global state for their internal purposes, and leave it in a state where external entities loading is enabled. This can lead to the situation where external XML is parsed with external entities loaded, which can lead to disclosure of any local files accessible to PHP. This vulnerable state may persist in the same process across many requests, until the process is shut down. |
 Ubuntu USN |
USN-6305-1 | PHP vulnerabilities |
| Ubuntu USN |
USN-6305-2 | PHP vulnerabilities |
Metrics
No CVSS v4.0
Attack Vector Network
Attack Complexity Low
Privileges Required None
Scope Unchanged
Confidentiality Impact High
Integrity Impact Low
Availability Impact Low
User Interaction None
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: 1.6% (1.640% probability within 30 days)
Key SSVC decision points have not yet been added.
References
History
Feb 13, 2025 5:15 PM
Description updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Description | In PHP versions 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8 various XML functions rely on libxml global state to track configuration variables, like whether external entities are loaded. This state is assumed to be unchanged unless the user explicitly changes it by calling appropriate function. However, since the state is process-global, other modules - such as ImageMagick - may also use this library within the same process, and change that global state for their internal purposes, and leave it in a state where external entities loading is enabled. This can lead to the situation where external XML is parsed with external entities loaded, which can lead to disclosure of any local files accessible to PHP. This vulnerable state may persist in the same process across many requests, until the process is shut down. | In PHP versions 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8 various XML functions rely on libxml global state to track configuration variables, like whether external entities are loaded. This state is assumed to be unchanged unless the user explicitly changes it by calling appropriate function. However, since the state is process-global, other modules - such as ImageMagick - may also use this library within the same process, and change that global state for their internal purposes, and leave it in a state where external entities loading is enabled. This can lead to the situation where external XML is parsed with external entities loaded, which can lead to disclosure of any local files accessible to PHP. This vulnerable state may persist in the same process across many requests, until the process is shut down. |
Subscriptions
Weaknesses
