⚠ Exploited in the wild
Exploitation observed in the wild. Not yet on CISA KEV.

CVE-2021-3007Deserialization of Untrusted Data in Laminas-http

Severity
9.8CRITICALNVD
EPSS
90.3%
top 0.40%
CISA KEV
Not in KEV
Exploit
Exploited in wild
Active exploitation observed
Timeline
PublishedJan 4
Latest updateNov 23

Description

Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the __destruct method of the Zend\Http\Response\Stream class in Stream.php. NOTE: Zend Framework is no longer supported by the maintainer. NOTE: the laminas-http vendor considers this a "vulnerability in the PHP language itself" but has added certain type checking as a way to prevent exploitation in (unrecommen

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages7 packages

Packagistlaminas/laminas-http< 2.14.2
NVDopenmage/magento20.0.020.0.9+1

Patches

🔴Vulnerability Details

7
OSV
Remote code execution in zendframework and laminas-http2021-06-08
GHSA
Remote code execution in zendframework and laminas-http2021-06-08
OSV
Fixes a bug in Zend Framework's Stream HTTP Wrapper2021-04-22
GHSA
Fixes a bug in Zend Framework's Stream HTTP Wrapper2021-04-22
CVEList
Fixes a bug in Zend Framework's Stream HTTP Wrapper2021-04-21

💥Exploits & PoCs

1
Nuclei
Laminas Project laminas-http - Remote Code Execution

🔍Detection Rules

1
Suricata
ET EXPLOIT Possible Zend Framework Exploit (CVE-2021-3007)2021-01-22

🕵️Threat Intelligence

4
Securelist
Cyberthreats to financial organizations in 20222021-11-23
Securelist
DDoS attacks in Q1 20212021-05-10
Securelist
DDoS attacks in Q1 20212021-05-10
Greynoiseio
How to Identify &amp; Disrupt C2s Using Graph Analysis
CVE-2021-3007 — Deserialization of Untrusted Data | cvebase