FILTER_VALIDATE_URL akzeptiert URLs mit ungültigem (userinfo)

An attacker can exploit CVE-2020-7071 by crafting a URL containing an invalid password and passing it to a PHP function that relies on URL validation. Because the validation function incorrectly identifies this URL as valid, subsequent code that processes the URL may misinterpret its components, leading to unexpected behavior or data errors. While this vulnerability does not directly lead to code execution, it can be exploited to manipulate application logic and potentially gain unauthorized access to data or functionality. The impact is particularly concerning in applications that rely on URL validation for security purposes, such as authentication or authorization.

1. Reserviert2020-01-15
2. Veröffentlicht2021-02-15
3. Geändert2024-09-16
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2020-7071 is to upgrade to PHP version 8.0.1 or later. If upgrading is not immediately feasible, implement additional validation checks on the URL after it has been validated by filter_var(). This could involve verifying the URL scheme, hostname, and path to ensure that it conforms to expected patterns. Consider using a more robust URL parsing library that provides more accurate and reliable validation. After upgrading, confirm the fix by attempting to validate a URL containing an invalid password and verifying that it is correctly identified as invalid.