GHSA-qr36-39c2-hp84: 
PHP vulnerability analysis and mitigation

Impact

Both clients build request URLs by joining caller-supplied IDs into the path without escaping them. Every request carries the BitGo access token. If an application passes an untrusted value (for example a transaction hash from a webhook body, or an ID from a user request) to one of the affected methods, that value can:

• leave the intended endpoint with ../ segments, for example getWalletTransaction('../../../user/me') requests /api/v2/{coin}/user/me;
• add query parameters with ?, for example getWalletTransaction('abc?prevId=1');
• turn a request for one object into a request for a list, with an empty string, . or ... The host is not affected. Requests still go only to BitGo or the configured BitGo Express instance, and the token is not sent anywhere else. The risk is that an authenticated request reaches a different BitGo endpoint than the application meant to call, and the application may return or act on that response. Affected methods: BitGoSDK::getWalletByAddress(), getWalletTransfer(), getWalletTransferBySequenceId(), getWalletAddress(), updateWalletAddress(), getWalletTransaction(), getKeychain(), getWalletShare(), resendWalletShareInvite(), cancelWalletShare(), removeWalletUser(), getPendingApproval(), simulateWalletWebhook(), simulateUserWebhook(); BitGoExpress::acceptWalletShare(), updatePendingApproval(); and every wallet method on both clients through the public $walletId property. The examples/receiveWebhook.php example passed the unauthenticated hash field of the webhook body to getWalletTransaction(). Applications based on it are affected.

Patches

Fixed in 2.3.1. Path parameters are percent-encoded, and empty, . and .. values throw an InvalidArgumentException. XRP addresses with ?dt= and XLM addresses with ?memoId= are sent as before.

Workarounds

Validate IDs before passing them to the SDK, for example allow only [0-9A-Za-z] (plus x for 0x hashes) for transaction hashes and wallet IDs.

References

• https://github.com/neto737/BitGoSDK-PHP/blob/main/CHANGELOG.md