GHSA-gwpm-pm6x-h7rj: 
PHP vulnerability analysis and mitigation

A Cross-Site Scripting (XSS) vulnerability was discovered in Zend Framework's Zend_Filter_StripTags component, affecting versions 1.7.0 through 1.7.6. The vulnerability allows attackers to bypass attribute whitelisting when attributes contain whitespace or line breaks surrounding the attribute assignment operator, potentially enabling XSS attacks. The issue was disclosed on February 27, 2009, and was assigned the identifier GHSA-gwpm-pm6x-h7rj (GitHub Advisory, Zend Advisory).

The vulnerability exists in the Zend_Filter_StripTags class, which is designed to function similarly to PHP's strip_tags() function. The component fails to properly handle attributes containing whitespace or line breaks around the attribute assignment operator, causing these attributes to remain in the output even when they are not explicitly whitelisted. For example, when using a filter configured to only allow 'href' attributes on 'a' tags, malicious 'onclick' attributes would still persist in the output if they contained specific whitespace patterns. The vulnerability has been assigned a CVSS v3.1 score of 6.1 (Moderate), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (GitHub Advisory).

The vulnerability could allow attackers to execute cross-site scripting (XSS) attacks by bypassing the attribute whitelisting mechanism. This could lead to unauthorized script execution in users' browsers, potentially compromising user data and session information. The impact is particularly significant in applications that rely on Zend_Filter_StripTags for XSS prevention (Zend Advisory).

The vulnerability can be exploited by crafting HTML input with specifically formatted attributes containing whitespace or line breaks around the assignment operator. The attack requires user interaction and can be executed remotely without requiring any privileges. The vulnerability has been classified with low attack complexity, indicating relatively straightforward exploitation (GitHub Advisory).

Users are strongly advised to upgrade to Zend Framework version 1.7.6 or later, which contains the patch for this vulnerability. For additional security, it is recommended to strip all tags rather than using whitelisting when relying on Zend_Filter_StripTags for XSS prevention. If whitelisting is necessary, users should consider implementing alternative XSS filtering solutions, such as HTML Purifier (Zend Advisory).