FrankenPHP Worker Mode Information Disclosure Vulnerability

Executive Summary

This vulnerability affects FrankenPHP versions before 1.13.4 in worker mode. It fails to clear HTTP response headers between requests, causing sensitive data like Set-Cookie or token headers from earlier requests to leak to subsequent requests on the same worker thread. The issue occurs because header resets only happen during RSHUTDOWN, which worker requests skip.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your FrankenPHP version is 1.13.3 or earlier. Run: frankenphp -v. If using worker mode, inspect application code for calls to http_get_last_response_headers() without prior http_clear_last_response_headers().

Monitor for unexpected header leaks in logs or responses. Test by sending multiple requests to the same worker thread and checking if headers from one request appear in another.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to access sensitive headers from other users' requests, potentially stealing session tokens, cookies, or authentication tokens. This could lead to unauthorized account access or data breaches if the leaked headers contain credentials or sensitive session data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate GDPR's data protection requirements by exposing personal data (e.g., cookies, tokens) without consent. For HIPAA, it may risk unauthorized access to protected health information if headers contain such data. Compliance requires patching to prevent data leaks.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade FrankenPHP to version 1.13.4 or later immediately. If upgrading is not possible, add http_clear_last_response_headers() at the start of each worker request as a temporary workaround.

Review and update any application code using http_get_last_response_headers() to ensure proper header isolation. Disable worker mode if not required.

Useful 0 Not Useful 0