Skip to content

Lack of Input Validation in zendesk_api_client_php for Zendesk Subdomain

Critical
thekindofme published GHSA-q348-f93x-9gx4 Apr 28, 2021

Package

zendesk_api_client_php

Affected versions

<v2.2.11

Patched versions

v2.2.11

Description

Impact

Lack of input validation of the Zendesk subdomain could expose users of the library to Server Side Request Forgery (SSRF).

Resolution

Validate the provided Zendesk subdomain to be a valid subdomain in:

  • getAuthUrl
  • getAccessToken

References

Severity

Critical

CVE ID

CVE-2021-30492

Weaknesses

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. Learn more on MITRE.