Vulnerability: Lack of Input Validation in zendesk_api_client_php for Zendesk Subdomain ### Impact
Lack of input validation of the Zendesk subdomain could expose users of the library to Server Side Request Forgery (SSRF).

### Resolution
Validate the provided Zendesk subdomain to be a valid subdomain in:
* getAuthUrl
* getAccessToken
Vulnerability ID: GHSA-q348-f93x-9gx4
CWE: CWE-20
Severity score: 0
Project: https://github.com/zendesk/zendesk_api_client_php
Published: 2021-04-29
File: src/Zendesk/API/Utilities/OAuth.php
Commit message: Merge pull request #466 from zendesk/validate-zendesk-subdomain
Commit author: Yasith Fernando

Vulnerable version (before fix):
  namespace Zendesk\API\Utilities;  use GuzzleHttp\Client; use GuzzleHttp\Exception\RequestException; use GuzzleHttp\Psr7\Request; class OAuth      */     public static function getAccessToken(Client $client, $subdomain, array $params, $domain = 'zendesk.com')     {         $authUrl  = "https://$subdomain.$domain/oauth/tokens";          // Fetch access_token public static function getAccessToken(Client $client, $subdomain, array $params,      */     public static function getAuthUrl($subdomain, array $options, $domain = 'zendesk.com')     {         $queryParams = [             'response_type' => 'code',             'client_id'    => null, public static function getAuthUrl($subdomain, array $options, $domain = 'zendesk          return $oAuthUrl;     } }

Fixed version (after fix):
  namespace Zendesk\API\Utilities;  use InvalidArgumentException; use GuzzleHttp\Client; use GuzzleHttp\Exception\RequestException; use GuzzleHttp\Psr7\Request; class OAuth      */     public static function getAccessToken(Client $client, $subdomain, array $params, $domain = 'zendesk.com')     {         static::validateSubdomain($subdomain);         $authUrl  = "https://$subdomain.$domain/oauth/tokens";          // Fetch access_token public static function getAccessToken(Client $client, $subdomain, array $params,      */     public static function getAuthUrl($subdomain, array $options, $domain = 'zendesk.com')     {         static::validateSubdomain($subdomain);         $queryParams = [             'response_type' => 'code',             'client_id'    => null, public static function getAuthUrl($subdomain, array $options, $domain = 'zendesk          return $oAuthUrl;     }      /**      * Validate subdomain      *      * @param string $subdomain      * @throws InvalidArgumentException      */     private static function validateSubdomain($subdomain)     {         if (! preg_match('/^[A-Za-z0-9](?:[A-Za-z0-9\-]{0,61}[A-Za-z0-9])?$/', $subdomain)) {             throw new InvalidArgumentException('Invalid Zendesk subdomain.');         }     } }

Patch:
patch: @@ -2,6 +2,7 @@
 
 namespace Zendesk\API\Utilities;
 
+use InvalidArgumentException;
 use GuzzleHttp\Client;
 use GuzzleHttp\Exception\RequestException;
 use GuzzleHttp\Psr7\Request;
@@ -22,6 +23,7 @@ class OAuth
      */
     public static function getAccessToken(Client $client, $subdomain, array $params, $domain = 'zendesk.com')
     {
+        static::validateSubdomain($subdomain);
         $authUrl  = "https://$subdomain.$domain/oauth/tokens";
 
         // Fetch access_token
@@ -55,6 +57,7 @@ public static function getAccessToken(Client $client, $subdomain, array $params,
      */
     public static function getAuthUrl($subdomain, array $options, $domain = 'zendesk.com')
     {
+        static::validateSubdomain($subdomain);
         $queryParams = [
             'response_type' => 'code',
             'client_id'    => null,
@@ -71,4 +74,17 @@ public static function getAuthUrl($subdomain, array $options, $domain = 'zendesk
 
         return $oAuthUrl;
     }
+
+    /**
+     * Validate subdomain
+     *
+     * @param string $subdomain
+     * @throws InvalidArgumentException
+     */
+    private static function validateSubdomain($subdomain)
+    {
+        if (! preg_match('/^[A-Za-z0-9](?:[A-Za-z0-9\-]{0,61}[A-Za-z0-9])?$/', $subdomain)) {
+            throw new InvalidArgumentException('Invalid Zendesk subdomain.');
+        }
+    }
 }
path: src/Zendesk/API/Utilities/OAuth.php