cbcvebase.
CVE-2024-11234
published 2024-11-24

CVE-2024-11234: In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, when using streams with configured proxy and "request_fulluri" option, the URI…

PriorityP344high7.2CVSS 3.1
AVNACLPRNUINSCCLILAN
EPSS
1.11%
63.7th percentile
In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, when using streams with configured proxy and "request_fulluri" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests originating from the server, thus potentially gaining access to resources not normally available to the external user.

Affected

19 ranges
VendorProductVersion rangeFixed in
debianphp7.4< php7.4 7.4.33-1+deb11u7 (bullseye)php7.4 7.4.33-1+deb11u7 (bullseye)
debianphp8.2< php7.4 7.4.33-1+deb11u7 (bullseye)php7.4 7.4.33-1+deb11u7 (bullseye)
msrcazl3_php_8.3.12-1_on_azure_linux_3.0
msrcazl3_php_8.3.14-1_on_azure_linux_3.0
msrcazure_linux_3.0_arm
msrcazure_linux_3.0_x64
msrccbl2_php_8.1.30-1_on_cbl_mariner_2.0
msrccbl2_php_8.1.31-1_on_cbl_mariner_2.0
msrccbl_mariner_2.0_arm
msrccbl_mariner_2.0_x64
phpphp>= 8.1.0 < 8.1.318.1.31
phpphp>= 8.2.0 < 8.2.268.2.26
phpphp>= 8.3.0 < 8.3.148.3.14
php_groupphp>= 8.1.* < 8.1.318.1.31
php_groupphp>= 8.2.* < 8.2.268.2.26
php_groupphp>= 8.3.* < 8.3.148.3.14
qemuqemu>= 0 < 1:6.2+dfsg-2ubuntu6.281:6.2+dfsg-2ubuntu6.28
qemuqemu>= 0 < 1:8.2.2+ds-0ubuntu1.131:8.2.2+ds-0ubuntu1.13
qemuqemu>= 0 < 1:10.1.0+ds-5ubuntu2.41:10.1.0+ds-5ubuntu2.4

CVSS provenance

nvdv3.17.2HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
osv8.2HIGH
vendor_msrc7.2HIGH
vendor_debian4.8MEDIUM
vendor_redhat4.8MEDIUM
vendor_ubuntu4.8MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.