GHSA-mg7h-9qfx-4r83: 
PHP vulnerability analysis and mitigation

Zend Framework versions 2.0.0 to 2.0.5 contain potential proxy injection vulnerabilities in multiple components (GHSA-mg7h-9qfx-4r83). The vulnerability affects Zend\Session\Validator\RemoteAddr and Zend\View\Helper\ServerUrl components, which were found to be improperly parsing HTTP headers for proxy information. This security issue was discovered and disclosed on November 29, 2012 (Zend Advisory).

The vulnerability stems from two main components: In Zend\Session\Validator\RemoteAddr, if the client is behind a proxy server, the detection of the proxy URL was incorrect and could lead to invalid results on subsequent lookups. In Zend\View\Helper\ServerUrl, the helper would always generate a URL based on the proxy host when the server was behind a proxy, regardless of whether this was desired, and it did not account for proxy port or protocol information. The vulnerability has a CVSS v3.1 score of 5.9 (Moderate) with vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N (GitHub Advisory).

The vulnerability could potentially allow an attacker to spoof a proxied IP or host name. This could lead to bypass of IP-based security controls and potentially result in unauthorized access to protected resources (Zend Advisory).

The vulnerability requires network access and has high attack complexity. No privileges are required to exploit the vulnerability, and no user interaction is needed. The vulnerability affects the integrity of the system but does not impact confidentiality or availability (GitHub Advisory).

The vulnerability was patched in Zend Framework version 2.0.5. The fix included the development of a new class, Zend\Http\PhpEnvironment\RemoteAddress, for handling client IP detection via proxy headers. The patch removed support for the non-standard Client-IP header, added the ability to specify which header to check for proxy detection, and implemented support for trusted proxy server lists. For the ServerUrl helper, proxy detection was disabled by default, and support for detecting proxy port and protocol was added (Zend Advisory).