Insecure Defaults Affecting nategood/httpful package, versions <1.0.0
Threat Intelligence
Exploit Maturity
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Proof of concept
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PHP-NATEGOODHTTPFUL-7924841
- published9 Sept 2024
- disclosed9 Sept 2024
- creditProf. Dr. Andreas Kurtz
Introduced: 9 Sep 2024
CVE NOT AVAILABLE CWE-453 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade nategood/httpful to version 1.0.0 or higher.
Overview
nategood/httpful is a Readable, chainable, REST-friendly, PHP HTTP client
Affected versions of this package are vulnerable to Insecure Defaults in the form of not enforcing SSL certificate verification in Httpful/Request.php. The default behavior is to use withoutStrictSSL() This allows an attacker to send an expired or otherwise invalid certificate, and have it accepted without verifying the originating host.
PoC
<?php
require("httpful/bootstrap.php");
$url = "https://self-signed.badssl.com";
// OR
$url = "https://untrusted-root.badssl.com";
$response = \Httpful\Request::get($url)
// Uncomment this to re-enable certificate validation as we would expect it to be by default
// ->withStrictSSL()
->send();
echo "{$response}";
?>