Yii2-Starter-Kit Debug Module Unauthorized Access Vulnerability

Executive Summary

This vulnerability affects yii2-starter-kit versions up to 4.2.0. The default development configuration sets allowedIPs to ['*'] for the Yii debug and Gii modules, making them accessible to all IP addresses. Unauthenticated remote attackers can access the debug endpoint to read sensitive data like session cookies and database queries, or use the Gii endpoint to generate and write PHP files into the application directory.

Useful 0 Not Useful 0

Detection Guidance

Check if the Yii debug or Gii modules are enabled in your Yii2 application configuration files. Look for files like web.php or main.php in the common/config or backend/config directories. Search for lines containing 'allowedIPs' set to ['*'] in debug or Gii module configurations.

Useful 0 Not Useful 0

Impact Analysis

Attackers can exploit this to read sensitive data such as session cookies and database queries via the debug endpoint. They can also generate and write PHP files through the Gii endpoint, leading to potential remote code execution and full system compromise.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Non-compliance may result in legal penalties and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Update yii2-starter-kit to a version beyond 4.2.0. If updating is not possible, modify the configuration files to restrict allowedIPs for debug and Gii modules to specific trusted IPs only. Disable these modules in production environments.

Useful 0 Not Useful 0