GHSA-xhr8-mpwq-2rr2: Cuyz/valinor Automatic Named Constructor Discovery Vulnerability

HIGH
Share
Published
Advisory Summary

GHSA-xhr8-mpwq-2rr2 is a HIGH automatic named constructor discovery vulnerability (General Security Weakness) affecting Cuyz/valinor libraries in the Packagist ecosystem. The issue involves automatic named constructor discovery in valinor. Remediation is available by upgrading affected packages to version 0.7.0.

GHSA-xhr8-mpwq-2rr2 at a Glance

CVE Identifier N/A
GHSA Identifier GHSA-xhr8-mpwq-2rr2
Severity HIGH
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Cuyz/valinor
Package Ecosystem Packagist
Published Date
Last Updated

How to Fix GHSA-xhr8-mpwq-2rr2

To remediate this vulnerability, upgrade all affected Cuyz/valinor dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

cuyz/valinor fixed: 0.7.0 
Upgrade cuyz/valinor to 0.7.0
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for cuyz/valinor

How to Check if You Are Affected

To determine whether your application is affected by GHSA-xhr8-mpwq-2rr2, inspect your project dependencies for Cuyz/valinor:

inspect dependencies for cuyz/valinor

Analyze the terminal output to locate any version of Cuyz/valinor in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.7.0), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Cuyz/valinor, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

## Design issue - automatic constructor discovery The issue arises when upgrading from `cuyz/valinor:0.3.0` to a newer system on an existing application, which broke due to the wrong constructor being picked. Still, a bigger security concern is problematic, and it is akin to https://github.com/rails/rails/issues/5228. ## Example exploit Take following DTO example: ```php final class UserDTO { public function __construct( public int $id, public string $name ) {} public static function fromDb( PDO $connection, int $id ): self { /* ... code to fetch the DTO here ... */ } } ``` There is nothing inherently unsafe about the above `UserDTO`, but when mixed with `cuyz/valinor:^0.5.0` ( specifically https://github.com/CuyZ/Valinor/commit/718d3c1bc2ea7d28b4b1f6c062addcd1dde8660b ), it is an explosive mix: ```php // this could be coming from user input: $maliciousPayload = [ 'connection' => [ 'dsn' => 'mysql:host=some-host;database=some-database', 'username' => 'root', 'password' => 'root', 'options' => [ // PDO::MYSQL_ATTR_INIT_COMMAND === 1002 1002 => 'DROP DATABASE all-the-moneys' ] ], 'id' => 123, ]; $treeMapper->map( UserDTO::class, $maliciousPayload ); // your DB is gone :D ``` The above payload is represented in PHP form, but may as well be input JSON, HTML or x-form-urlencoded. ## Mitigation Version 0.7.0 contains a patch for this issue. Automatic named constructor resolution should be disabled - only explicitly mapped named constructors should be used/discovered.

GHSA-xhr8-mpwq-2rr2 Affected Cuyz/valinor Versions

1 component(s)
Fixed Versions:
0.7.0
Product / Package Ecosystem Affected Versions Fixed Version
cuyz/valinor
 Packagist
≥ 0.5.0
< 0.7.0
0.7.0

References

GitHub Advisory / Wiki ADVISORY
https://github.com/CuyZ/Valinor/security/advisories/GHSA-xhr8-mpwq-2rr2
Security Fix Commit FIX COMMIT
https://github.com/CuyZ/Valinor/commit/718d3c1bc2ea7d28b4b1f6c062addcd1dde8660b
Cuyz/valinor Source Repository REPOSITORY
https://github.com/CuyZ/Valinor
Cuyz/valinor Release RELEASE
https://github.com/CuyZ/Valinor/releases/tag/0.7.0

Frequently Asked Questions

What is GHSA-xhr8-mpwq-2rr2?
GHSA-xhr8-mpwq-2rr2 is a security vulnerability in Cuyz/valinor involving Automatic named constructor discovery in Valinor under General Security Weakness.
Which Cuyz/valinor versions are affected?
Affected versions include releases prior to 0.7.0 across affected packages: cuyz/valinor.
What version fixes GHSA-xhr8-mpwq-2rr2?
Upgrading to 0.7.0 (or the latest patched release for your respective branch) resolves the vulnerability.
Is cuyz/valinor affected?
Yes, cuyz/valinor is affected in releases prior to 0.7.0. Upgrade your dependency to 0.7.0 or later.
What CWE is associated with GHSA-xhr8-mpwq-2rr2?
GHSA-xhr8-mpwq-2rr2 is classified under General Security Weakness.
How can I check Packagist dependencies for GHSA-xhr8-mpwq-2rr2?
Run the dependency tree command: 'inspect dependencies for cuyz/valinor'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-xhr8-mpwq-2rr2",
  "modified" : "2022-04-01T13:39:45Z",
  "published" : "2022-04-01T13:39:45Z",
  "aliases" : [ ],
  "summary" : "Automatic named constructor discovery in Valinor",
  "details" : "## Design issue - automatic constructor discovery\n\nThe issue arises when upgrading from `cuyz/valinor:0.3.0` to a newer system on an existing application, which broke due to the wrong constructor being picked.\n\nStill, a bigger security concern is problematic, and it is akin to https://github.com/rails/rails/issues/5228.\n\n## Example exploit\n\nTake following DTO example:\n\n```php\nfinal class UserDTO\n{\n    public function __construct(\n        public int $id,\n        public string $name\n    ) {}\n    public static function fromDb(\n        PDO $connection,\n        int $id\n    ): self { /* ... code to fetch the DTO here ... */ }\n}\n```\n\nThere is nothing inherently unsafe about the above `UserDTO`, but when mixed with `cuyz/valinor:^0.5.0` ( specifically https://github.com/CuyZ/Valinor/commit/718d3c1bc2ea7d28b4b1f6c062addcd1dde8660b ), it is an explosive mix:\n\n```php\n// this could be coming from user input:\n$maliciousPayload = [\n    'connection' => [\n      'dsn' => 'mysql:host=some-host;database=some-database',\n      'username' => 'root',\n      'password' => 'root',\n      'options' => [\n        // PDO::MYSQL_ATTR_INIT_COMMAND === 1002\n        1002 => 'DROP DATABASE all-the-moneys'\n      ]\n    ],\n    'id' => 123,\n];\n\n$treeMapper->map(\n  UserDTO::class,\n  $maliciousPayload\n); // your DB is gone :D\n```\n\nThe above payload is represented in PHP form, but may as well be input JSON, HTML or x-form-urlencoded.\n\n## Mitigation\n\nVersion 0.7.0 contains a patch for this issue.\n\nAutomatic named constructor resolution should be disabled - only explicitly mapped named constructors should be used/discovered.",
  "severity" : [ ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "cuyz/valinor"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0.5.0"
      }, {
        "fixed" : "0.7.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/CuyZ/Valinor/security/advisories/GHSA-xhr8-mpwq-2rr2"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/CuyZ/Valinor/commit/718d3c1bc2ea7d28b4b1f6c062addcd1dde8660b"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/CuyZ/Valinor"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/CuyZ/Valinor/releases/tag/0.7.0"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2022-04-01T13:39:45Z",
    "nvd_published_at" : null
  }
}