主机名中的空字节终止

该漏洞允许攻击者通过在主机名中注入空字符，绕过应用程序的安全检查。攻击者可以利用此漏洞构造恶意的 URL，欺骗应用程序访问未经授权的资源或执行恶意代码。例如，如果应用程序使用 parse_url() 函数来验证用户提供的 URL，攻击者可以注入空字符来绕过验证，从而访问敏感数据或执行未经授权的操作。虽然 CVSS 评分为低危，但如果应用程序依赖于主机名验证来保护敏感资源，则该漏洞可能被利用。

Applications built using PHP that rely on user-supplied hostnames for access control or resource identification are at risk. This includes web applications that connect to external services or databases using dynamically constructed URLs. Legacy PHP applications with outdated security practices are particularly vulnerable.

• php: Examine PHP application code for instances of fsockopen() and parse_url() where hostnames are used without proper validation. Look for patterns where user-supplied input is directly passed to these functions.

// Example of vulnerable code
$hostname = $_GET['hostname'];
$url = parse_url('http://' . $hostname);
$ip = $url['host'];

• linux / server: Monitor PHP error logs (typically in /var/log/php_errors.log) for errors related to URL parsing or hostname resolution. Use journalctl -u php-fpm to filter for relevant errors. • generic web: Use curl to test endpoints that accept hostnames as parameters. Attempt to inject null characters into the hostname and observe the response. curl -H "Host: example.com%00" http://your-application/

1. 2025-07-13Disclosure

   disclosure

1. 已保留2025-02-11
2. 发布日期2025-07-13
3. 修改日期2025-11-04
4. EPSS 更新日期2026-04-02

为了缓解 CVE-2025-1220 漏洞，建议立即升级到 PHP 8.4.10 或更高版本。如果无法立即升级，可以考虑以下临时缓解措施：在应用程序代码中对用户提供的主机名进行严格的输入验证，确保主机名不包含空字符。使用 Web 应用防火墙 (WAF) 或代理服务器来过滤包含恶意字符的请求。对应用程序的配置进行审查，确保没有不必要的权限或访问控制绕过。