Sign in
Deutsch English Español Polski
Medium

ZendFramework Cross-site Scripting vector in `Zend_Filter_StripTags`

  • Disclosed: 07.06.2024
  • Updated: 11.10.2026 10:22

Zend_Filter_StripTags is a filtering class analogous to PHP's strip_tags() function. In addition to stripping HTML tags and selectively keeping those provided in a whitelist, it also provides the ability to whitelist specific attributes to retain per whitelisted tag.

The reporter discovered that attributes that contained whitespace, and in paricular, line breaks, surrounding the attribute assignment operator would not be stripped, regardless of whether or not they were whitelisted. As examples of input affected:

<!-- newlines before and/or after assignment: -->
<a href="http://framework.zend.com/issues" onclick
=
"alert('Broken'); return false;">Issues</a>

When passed to the following code:

$filter = new Zend_Filter_StripTags(array('a' => array('href')));
$value  = $filter->($html);

then the "onclick" attribute would remain, even though it was not specified in the tag's whitelist. This could open potential cross-site scripting attack (XSS) vectors.

Recommendations

If you were using Zend_Filter_StripTags and utlizing the attribute whitelisting functionality, you should immediately upgrade to Zend Framework 1.7.6 or above; regardless, it is always best to run the most current version of the framework.

Also, if relying on Zend_Filter_StripTags to prevent XSS, the only way to reliably do so is to strip all tags, and never to whitelist. If you are whitelisting, you should consider finding a reliable XSS filter through which to run your output; we recommend HTML Purifier.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Composer package zendframework/zendframework1 >= 1.7.0, < 1.7.6 1.7.6

References

CVSS score 6.1/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness (CWE)
CWE-79
Platform
Composer
Package
zendframework/zendframework1
Disclosed
07.06.2024
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-gwpm-pm6x-h7rj - CC BY 4.0

Vulnerability history: zendframework/zendframework1

All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (34) in the archive
Total entries
34
First → latest
05.2022 06.2024
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • Critical 8
  • High 9
  • Medium 17

Disclosures per year

Severity:
  1. Zendframework1 Potential SQL injection in ORDER and GROUP functions
    Critical · 9.8 ghsa-6fqw-j3vm-7f66 < 1.12.20 1.12.20
  2. Zendframework Potential Information Disclosure and Insufficient Entropy vulnerability
    High · 7.5 ghsa-848f-mph5-9pm9 >= 1.12.0, < 1.12.17 1.12.17
  3. ZendFramework1 Potential Insufficient Entropy Vulnerability
    High · 7.5 ghsa-8xhv-gqm4-3w99 >= 1.12.0, < 1.12.18 1.12.18
  4. Zendframework1 potential SQL injection vector using null byte for PDO (MsSql, SQLite)
    Critical · 9.8 ghsa-v42g-7q2x-cw32 >= 1.12.0, < 1.12.16 1.12.16
  5. ZendFramework1 Potential SQL injection in the ORDER implementation of Zend_Db_Select
    Critical · 9.8 ghsa-2x36-qhx3-7m5f >= 1.12.0, < 1.12.7 1.12.7
  6. Zendframework potential security issue in login mechanism
    High · 7.5 ghsa-9v78-h226-2rmq >= 1.12.0, < 1.12.4 1.12.4
  7. Zendframework Local file disclosure via XXE injection in Zend_XmlRpc
    High · 8.6 ghsa-229x-22xc-2f2w >= 1.0.0, < 1.11.13 1.11.13
  8. Zendframework Denial of Service vector via XEE injection
    High · 7.5 ghsa-2jx7-xg83-j2m7 >= 1.0.0, < 1.11.13 1.11.13
  9. ZendFramework Cross-site Scripting vector in `Zend_Filter_StripTags` this entry
    Medium · 6.1 ghsa-gwpm-pm6x-h7rj >= 1.7.0, < 1.7.6 1.7.6
  10. ZendFramework potential XML eXternal Entity injection vectors
    Critical · 9.8 ghsa-mhpx-3rv8-wrjm >= 1.12.0, < 1.12.4 1.12.4
  11. ZendFramework potential XML eXternal Entity injection vectors
    High · 7.5 ghsa-4j9x-g4x8-vcmf >= 1.11.0, < 1.11.15, >= 1.12.0, < 1.12.1 1.11.15, 1.12.1
  12. ZendFramework potential SQL Injection Vector When Using PDO_MySql
    Critical · 9.8 ghsa-qf36-fx9f-232x >= 1.10.0, < 1.10.9, >= 1.11.0, < 1.11.6 1.10.9, 1.11.6
  13. ZendFramework local file inclusion vector in `Zend_View::setScriptPath()` and `render()`
    High · 7.5 ghsa-hx3m-959f-v849 >= 1.7.0, < 1.7.5 1.7.5
  14. Zend Framework SQL injection vulnerability
    Critical · 9.8 CVE-2014-8089 >= 1.12.0, < 1.12.9 1.12.9
  15. Zend Framework XXE Vulnerability
    High · 7.3 CVE-2012-3363 >= 1.0.0, < 1.11.12, >= 1.12.0-rc1, < 1.12.0 1.11.12, 1.12.0
  16. Doctrine Security Misconfiguration Vulnerability
    High · 7.8 CVE-2015-5723 >= 1.12.0, < 1.12.16 1.12.16
  17. Zend Framework SQL injection vector using null byte for PDO
    Critical · 9.8 CVE-2015-7695 < 1.12.16 1.12.16
  18. Zend Framework Allows SQL Injection
    Critical · 9.8 CVE-2016-6233 < 1.12.19 1.12.19

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.