Zendframework Denial of Service vector via XEE injection
Date: 2024-06
Affected: composer/zendframework/zendframework1
Attack vector: dos
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2012-6532
CWE: CWE-776
CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

`Zend_Dom`, `Zend_Feed`, `Zend_Soap`, and `Zend_XmlRpc` are vulnerable to XML Entity Expansion (XEE) vectors, leading to Denial of Service vectors. XEE attacks occur when the XML DOCTYPE declaration includes XML entity definitions that contain either recursive or circular references; this leads to CPU and memory consumption, making Denial of Service exploits trivial to implement.


Mitigations:

Architectural layers (MAESTRO):