1 Vulnerability Overview
Recently, ThinkPHP 5.0.* is prone to a remote code execution vulnerability that has been officially fixed. All related users should stay wary and take precautions as soon as possible.
2 Scope of Impact
Affected Version
- ThinkPHP 5.0.*
Unaffected Version
- ThinkPHP 5.0.24
3 Vulnerability Check
3.1 Version Check
Use a text editor to open thinkphp\base.php and then you can find the version number of the current framework from the section of code on constant definitions.
If the version is vulnerable, please take precautions as soon as possible to fix the vulnerability.
4 Vulnerability Protection
4.1 Version Upgrade
ThinkPHP5 allows users to use Composer for installing updates. Users are advised to back up applications and modified directories, open the Command Prompt program in the root directory and then execute one of the following commands.
composer update topthink/framework 5.0.24
composer update topthink/framework=5.0.24
composer update topthink/framework:5.0.24
Note: If the user uses an early ThinkPHP5 version, a compatibility problem may arise during the upgrade. In this case, it is recommended that the user perform the upgrade according to the upgrade procedure described in the official user guide. To obtain the user guide, visit the following link:
https://www.kancloud.cn/manual/thinkphp5/163239
4.2 Code Fix
This vulnerability exists in the ThinkPHP Request class for processing requests. Users can also fix this vulnerability by improving the Request class. For details, visit the following link:
https://github.com/top-think/framework/commit/4a4b5e64fa4c46f851b4004005bff5f3196de003
Use the editor to open \thinkphp\library\think\Request.php and locate the code in lines 525 and 526:
Save the changes.
Appendix
-
Statement
This advisory is only used to describe a potential risk. NSFOCUS does not provide any commitment or promise on this advisory. NSFOCUS and the author will not bear any liability for any direct and/or indirect consequences and losses caused by transmitting and/or using this advisory. NSFOCUS reserves all the rights to modify and interpret this advisory. Please include this statement paragraph when reproducing or transferring this advisory. Do not modify this advisory, add/delete any information to/from it, or use this advisory for commercial purposes without permission from NSFOCUS.
-
About NSFOCUS
NSFOCUS IB is a wholly owned subsidiary of NSFOCUS, an enterprise application and network security provider, with operations in the Americas, Europe, the Middle East, Southeast Asia and Japan. NSFOCUS IB has a proven track record of combatting the increasingly complex cyber threat landscape through the construction and implementation of multi-layered defense systems. The company’s Intelligent Hybrid Security strategy utilizes both cloud and on-premises security platforms, built on a foundation of real-time global threat intelligence, to provide unified, multi-layer protection from advanced cyber threats.
For more information about NSFOCUS, please visit:
https://www.nsfocusglobal.com.
NSFOCUS, NSFOCUS IB, and NSFOCUS, INC. are trademarks or registered trademarks of NSFOCUS, Inc. All other names and trademarks are property of their respective firms.
