GHSA-jmmp-vh96-78rm: 
PHP vulnerability analysis and mitigation

The vulnerability (GHSA-jmmp-vh96-78rm) affects multiple Zend Framework components including zend-diactoros, zend-http, and zend-feed (specifically its PubSubHubbub sub-component). The issue was discovered in June 2018 and patched in version 2.10.3 released on August 1, 2018. The vulnerability affects all versions from 1.0.0 to versions before 2.10.3 (Zend Advisory).

The vulnerability stems from how the components handle URL rewrite mechanisms. When marshaling a request URI, the code would inspect HTTP request headers specific to server-side URL rewrite mechanisms. The vulnerability exists because the code would process these headers even on systems not running the specific URL rewriting mechanism, which could allow malicious clients or proxies to manipulate these headers to request arbitrary content. The vulnerability has a CVSS v3.1 score of 7.5 (High), with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (GitHub Advisory).

The vulnerability could allow malicious clients or proxies to emulate specific URL rewrite headers to request arbitrary content, potentially leading to unauthorized access to resources. The CVSS metrics indicate high impact on integrity while maintaining normal scope, requiring no privileges or user interaction (GitHub Advisory).

The vulnerability is exploitable over the network with low attack complexity. It requires no privileges or user interaction, making it relatively straightforward to exploit. The attack vector is network-based, allowing remote exploitation (GitHub Advisory).

The vulnerability was patched in version 2.10.3 of zend-feed. The fix removes support for the X-Rewrite-Url and X-Original-Url headers in the request URI marshaling process. Users are recommended to update to version 2.10.3 or later. For those who need to maintain support for ISAPI_Rewrite, it's recommended to override the _detectCallbackUrl method and ensure proper header filtering at the web server level (Zend Advisory).