Security researchers have uncovered a sophisticated XML External Entity (XXE) injection vulnerability in PHP applications that could allow attackers to access sensitive configuration files and private keys. The vulnerability, discovered by researcher Aleksandr Zhurnakov, affects PHP applications using certain libxml flags during XML processing, potentially exposing critical server-side information even with standard security measures in place. The vulnerability enables attackers to bypass multiple security mechanisms designed to prevent XXE attacks, including the LIBXML_NONET flag which is intended to block external network connections during XML parsing. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. The vulnerability has already been discovered in SimpleSAMLphp (CVE-2024-52596), where it allowed unauthorized users to read configuration files and access private keys used for signing SAML assertions. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. Tushar is a Cyber security content editor with a passion for creating captivating and informative content.
This Cyber News was published on cybersecuritynews.com. Publication date: Wed, 12 Mar 2025 13:35:20 +0000