GHSA-f4fj-q6m4-cc52: 
PHP vulnerability analysis and mitigation

The vulnerability (GHSA-f4fj-q6m4-cc52) affects ZendFramework's XML processing components, specifically related to PHP's DOMDocument, SimpleXML, and xml_parse functionality. The issue was discovered and disclosed in February 2014, affecting versions >=2.1.0, <2.1.6 and >=2.2.0, <2.2.6 of the zendframework/zend-xmlrpc package (Zend Advisory).

The vulnerability encompasses two distinct attack vectors: XML eXternal Entity (XXE) Injection attacks and XML Entity Expansion (XEE) attacks. The PHP extensions were found to be insecure by default, allowing external entities to be specified through DOCTYPE elements in XML documents. The vulnerability received a Critical severity rating with a CVSS score of 9.8, indicating high impact across confidentiality, integrity, and availability metrics (GitHub Advisory).

The vulnerability could allow attackers to perform two types of attacks: XXE injection attacks that could coerce applications to open arbitrary files and/or TCP connections, and XEE attacks that could lead to Denial of Service through CPU and memory consumption when XML DOCTYPE declarations include recursive or circular entity references (Zend Advisory).

The vulnerability is exploitable through XML input containing malicious DOCTYPE elements. The affected PHP extensions (DOMDocument, SimpleXML, and xml_parse) were insecure by default, making exploitation straightforward for attackers who could provide XML input to the application (GitHub Advisory).

The issue was addressed by implementing new security components (Zend_Xml_Security in ZF1 and standalone ZendXml) that scan and load XML documents safely. The fix uses libxml_disable_entity_loader() to disable ENTITY nodes loading and includes checks for ENTITY elements in document type declarations. Additionally, a specific handling for PHP-FPM scenarios was implemented due to PHP bug 64938 (Zend Advisory).