CVE-2024-32877: 
Yii vulnerability analysis and mitigation

Yii 2, a PHP application framework, was found to contain a Cross-site Scripting (XSS) vulnerability in version 2.0.49.3, discovered during internal penetration testing. The vulnerability exists in the mechanism for displaying function argument values in the stack trace when the framework is in debug mode. The issue was disclosed on May 30, 2024, and has been assigned CVE-2024-32877 (GitHub Advisory).

The vulnerability manifests when an argument's value exceeds 32 characters in the stack trace display. For values exceeding this limit, the system truncates them and adds '...' with the full value shown in a title attribute of a span tag on hover. The security flaw allows attackers to break out of the title attribute's value context using double quotes and inject malicious attributes, including JavaScript code through event handlers such as onmousemove. The root cause was traced to changes in the htmlEncode method in framework/web/ErrorHandler.php, where the ENT_NOQUOTES flag disabled encoding for single and double quotes (GitHub Commit). The vulnerability has been assigned a CVSS v3.1 score of 4.2 (Medium) with vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N (GitHub Advisory).

The vulnerability enables attackers to execute arbitrary JavaScript code in the security context of the victim's site through specially crafted links. This can result in the theft of cookies (including httpOnly cookies accessible on the page), content substitution, or complete takeover of user accounts (GitHub Advisory).

The vulnerability is exploitable when the framework is in debug mode (YII_DEBUG set to true) and the php.ini setting zend.exception_ignore_args is set to Off (default value). An attacker needs to induce an exception in the application, leading to a stack trace page being displayed (GitHub Advisory).

The vulnerability has been patched in version 2.0.50. The fix involves modifying the htmlEncode method to use ENT_QUOTES | ENT_SUBSTITUTE | ENT_HTML5 flags instead of ENT_NOQUOTES. Users are strongly advised to upgrade to the patched version as there are no known workarounds for this vulnerability (GitHub Advisory).