Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
Zend Framework: Malicious OpenID Login Possible with Unsecured Accounts
published 2 years ago
Summary
Using Zend Framework's OpenID feature, an attacker can log in to your site with any OpenID account, without needing the account's secret information. This is a security risk because it allows an attacker to impersonate any OpenID account, including ones not controlled by your site. To fix this, update your Zend Framework to the latest version, which includes security patches for this issue.
What to do
- Update zendframework zendframework1 to version 1.12.4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | zendframework | zendframework1 |
>= 1.12.0, < 1.12.4 Fix: upgrade to 1.12.4
|
Original advisory text
Zendframework potential security issue in login mechanism
Using the Consumer component of ZendOpenId (or Zend_OpenId in ZF1), it is possible to login using an arbitrary OpenID account (without knowing any secret information) by using a malicious OpenID Provider. That means OpenID it is possible to login using arbitrary OpenID Identity (MyOpenID, Google, etc), which are not under the control of our own OpenID Provider. Thus, we are able to impersonate any OpenID Identity against the framework.
Moreover, the Consumer accepts OpenID tokens with arbitrary signed elements. The framework does not check if, for example, both openid.claimed_id and openid.endpoint_url are signed. It is just sufficient to sign one parameter. According to https://openid.net/specs/openid-authentication-2_0.html#positive_assertions, at least op_endpoint, return_to, response_nonce, assoc_handle, and, if present in the response, claimed_id and identity, must be signed.
Moreover, the Consumer accepts OpenID tokens with arbitrary signed elements. The framework does not check if, for example, both openid.claimed_id and openid.endpoint_url are signed. It is just sufficient to sign one parameter. According to https://openid.net/specs/openid-authentication-2_0.html#positive_assertions, at least op_endpoint, return_to, response_nonce, assoc_handle, and, if present in the response, claimed_id and identity, must be signed.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-287Improper Authentication
Timeline
Published7 Jun 2024
Updated6 Mar 2026
First seen6 Mar 2026
Sources
GHSA-9v78-h226-2rmq · GHSA
Track software like this
Free during beta