XXE in Php
CVE-2023-3823
In PHP versions 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8 various XML functions rely on libxml global state to track configuration variables, like whether external entities are loaded. This state is assumed to be unchanged unless the user explicitly changes it by calling appropriate function. However, since the state is process-global, other modules - such as ImageMagick - may also use this library within the same process, and change that global state for their internal purposes, and leave it in a state where external entities loading is enabled. This can lead to the situation where external XML is parsed with external entities loaded, which can lead to disclosure of any local files accessible to PHP. This vulnerable state may persist in the same process across many requests, until the process is shut down.
Vulnerability class: XXE (XML External Entity)
EPSS: 0.014 (69.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L.
Affected products
- Php
- Php Group — versions 8.0.*, 8.1.*, 8.2.*
- Debian Debian_linux — versions 10.0
- Fedoraproject Fedora — versions 38
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@php.net (Exploit, Third Party Advisory)
- security@php.net (Mailing List)
- security@php.net (Third Party Advisory)
- security@php.net (Mailing List)
Frequently asked questions
- What is CVE-2023-3823?
- CVE-2023-3823 is a high-severity vulnerability in Php, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 8.6/10. Published 2023-08-11.
- How severe is CVE-2023-3823?
- High severity. CVSS v3 base score is 8.6 out of 10.
- Is CVE-2023-3823 known to be exploited?
- 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.