CRITICAL🇵🇱 Wersja polska

CVE-2024-4990

CVSS 9.1v3.1pub. 2025-03-20upd. 2025-04-01

In yiisoft/yii2 version 2.0.48, the base Component class contains a vulnerability where the `__set()` magic method does not validate that the value passed is a valid Behavior class name or configuration. This allows an attacker to instantiate arbitrary classes, passing parameters to their constructors and invoking setter methods. Depending on the installed dependencies, various types of attacks are possible, including the execution of arbitrary code, retrieval of sensitive information, and unauthorized access.

🤖 AI Analysis
How it works

The magic method `__set()` of the Component class does not verify whether the passed value is a valid Behavior class name or a proper configuration. An attacker can effectively force the application to instantiate any class available in the PHP environment, passing parameters to its constructor and invoking setter methods. The vulnerability is remotely exploitable, without authentication and without requiring user interaction (CVSS vector: AV:N/AC:L/PR:N/UI:N). Specific consequences depend on the classes available in the project and its dependencies (attack type: 'PHP Object/Class Instantiation Gadget Chain').

Impact

An attacker can lead to arbitrary code execution (RCE), obtain sensitive information, or gain unauthorized access to the system. Impact on confidentiality and availability assessed as high (C:H, A:H).

Mitigation & patch

Apply patches available from the vendor according to the references. Urgent update of the yiisoft/yii2 library above version 2.0.48 is recommended, along with verification of installed dependencies for potential gadget chains.

Who is affected

Yiiframework Yii2 (yiisoft/yii2) version 2.0.48

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
  • Yiiframework Yii

    APP
    Yiiframework
    2.0.48
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2024-58136CRITICAL9.0⚠ KEVPL ✓same product

Yii 2 — nieprawidłowa obsługa behavior z kluczem __class umożliwia RCE

CVE-2015-5467CRITICAL9.8PL ✓same product

Path Traversal w Yii2 umożliwiający wykonanie dowolnego pliku PHP

CVE-2023-26750CRITICAL9.8PL ✓same product

SQL injection w Yii 2 Framework umożliwiający zdalne wykonanie kodu

CVE-2018-8073CRITICAL9.8PL ✓same product

Zdalne wykonanie kodu LUA w Yii Framework przez rozszerzenie Redis

CVE-2018-7269CRITICAL9.8PL ✓same product

SQL Injection w Yii 2.x — podatna funkcja findByCondition()