In yiisoft/yii2 version 2.0.48, the base Component class contains a vulnerability where the `__set()` magic method does not validate that the value passed is a valid Behavior class name or configuration. This allows an attacker to instantiate arbitrary classes, passing parameters to their constructors and invoking setter methods. Depending on the installed dependencies, various types of attacks are possible, including the execution of arbitrary code, retrieval of sensitive information, and unauthorized access.
The magic method `__set()` of the Component class does not verify whether the passed value is a valid Behavior class name or a proper configuration. An attacker can effectively force the application to instantiate any class available in the PHP environment, passing parameters to its constructor and invoking setter methods. The vulnerability is remotely exploitable, without authentication and without requiring user interaction (CVSS vector: AV:N/AC:L/PR:N/UI:N). Specific consequences depend on the classes available in the project and its dependencies (attack type: 'PHP Object/Class Instantiation Gadget Chain').
An attacker can lead to arbitrary code execution (RCE), obtain sensitive information, or gain unauthorized access to the system. Impact on confidentiality and availability assessed as high (C:H, A:H).
Apply patches available from the vendor according to the references. Urgent update of the yiisoft/yii2 library above version 2.0.48 is recommended, along with verification of installed dependencies for potential gadget chains.
Yiiframework Yii2 (yiisoft/yii2) version 2.0.48
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:HYiiframework Yii
APPYiiframework2.0.48
Related vulnerabilities
Yii 2 — nieprawidłowa obsługa behavior z kluczem __class umożliwia RCE
Path Traversal w Yii2 umożliwiający wykonanie dowolnego pliku PHP
SQL injection w Yii 2 Framework umożliwiający zdalne wykonanie kodu
Zdalne wykonanie kodu LUA w Yii Framework przez rozszerzenie Redis
SQL Injection w Yii 2.x — podatna funkcja findByCondition()