Executive Summary

This vulnerability exists in the phpseclib PHP secure communications library versions from 0.1.1 up to 1.0.30, 2.0.55, and 3.0.54. When an application uses phpseclib to validate an untrusted X.509 certificate, the function X509::validateSignature() reads a URL from the certificate's Authority Information Access (AIA) extension and connects to it.

Because the attacker fully controls the host, port, and path of this URL, and URL fetching is enabled by default without any destination blocking, an unauthenticated attacker can cause the validating server to open connections to internal hosts and ports it should never reach. This includes sensitive internal addresses like loopback (127.0.0.1), cloud metadata services (169.254.169.254), and other internal-only services.

This behavior results in a server-side request forgery (SSRF) vulnerability caused by an insecure default configuration. The issue has been fixed in versions 1.0.30, 2.0.55, and 3.0.54.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an unauthenticated attacker to make your server initiate unauthorized network connections to internal systems and services that should be inaccessible externally.

Such unauthorized connections can lead to exposure of sensitive internal resources, potential data leakage, or further exploitation of internal services that are normally protected by network boundaries.

Because the attacker controls the destination of these connections, they could target critical internal infrastructure such as loopback interfaces, cloud metadata endpoints, or other internal-only services, potentially compromising the security and integrity of your environment.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade phpseclib to version 1.0.30, 2.0.55, or 3.0.54 or later, where the issue is fixed.

Useful 0 Not Useful 0