Executive brief
A security vulnerability exists in phpseclib, a popular PHP library used for handling encryption and digital certificates. When the library validates a certificate provided by a user, it automatically attempts to download additional data from web addresses specified within that certificate. An attacker can provide a specially crafted certificate that forces the server to make unauthorized connections to internal systems, such as private databases, administrative panels, or cloud configuration services, potentially exposing internal network structure or sensitive metadata.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in phpseclib's X.509 certificate validation logic. When `X509::validateSignature()` is called on a certificate with an unknown issuer, the library attempts 'AIA chasing' by extracting a URL from the `id-ad-caIssuers` field of the Authority Information Access extension. The `fetchURL()` method, which is enabled by default via `$disable_url_fetch = false`, uses `fsockopen` to connect to the extracted URL without validating the destination host, port, or scheme. An unauthenticated remote attacker can provide a malicious certificate to trigger outbound requests to arbitrary internal IP addresses (including loopback and cloud metadata services like 169.254.169.254) and ports. While the attacker cannot directly read the response body unless it is a valid certificate, the flaw allows for internal port scanning and interaction with internal HTTP services. Patches are available in versions 1.0.30, 2.0.55, and 3.0.54.
Affected products
- phpseclib phpseclib/phpseclib >= 0.1.1, <= 1.0.29; >= 2.0.0, <= 2.0.54; >= 3.0.0, <= 3.0.53
Timeline
- 2026-06-14: advisory: Initial GitHub Advisory publication
- 2026-06-16: patched: Advisory updated with patched versions
References
- https://api.github.com/users/EvidentObscurity
- https://github.com/EvidentObscurity
- https://api.github.com/users/EvidentObscurity/gists%7B/gist_id%7D
- https://api.github.com/users/EvidentObscurity/repos
- https://avatars.githubusercontent.com/u/16970217?v=4
- https://api.github.com/users/EvidentObscurity/events%7B/privacy%7D