Skip to content
OpenAdvisories
Critical · 9.8 Scanner template Public exploit CVE-2021-3007 EUVD-2021-1428GHSA-xx8f-qf9f-5fgw

Remote code execution in zendframework and laminas-http

Published Jan 4, 2021 · Updated Aug 3, 2024 · Assigned by mitre

Package: laminas/laminas-http Package: zendframework/zendframework Ecosystem: Packagist

Description

Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the __destruct method of the Zend\Http\Response\Stream class in Stream.php. NOTE: Zend Framework is no longer supported by the maintainer. NOTE: the laminas-http vendor considers this a "vulnerability in the PHP language itself" but has added certain type checking as a way to prevent exploitation in (unrecommended) use cases where attacker-supplied data can be deserialized

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 3 repositories

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist laminas/laminas-http < 2.14.2 2.14.2 GHSA-xx8f-qf9f-5fgw
Packagist zendframework/zendframework <= 3.0.0 — GHSA-xx8f-qf9f-5fgw

References