Kiota PHP Code Generator Vulnerable to Code Injection Attack
The Kiota PHP code generator is reportedly vulnerable to a code generation literal injection attack. Users of the Kiota PHP code generator (nuget) should assess their exposure.
What happened
An early warning has been issued regarding a potential vulnerability in the Kiota PHP code generator. The vulnerability, tracked as GHSA-JQWH-526H-C92J, appears to allow an attacker to inject arbitrary PHP code into generated model and request-builder classes through a code generation literal injection attack. This could potentially lead to remote code execution if exploited. The vulnerability is under investigation, and it is recommended that users of the Kiota PHP code generator upgrade to the latest version and review any generated code for signs of tampering. For more details, consult the primary source at https://github.com/microsoft/kiota/security/advisories/GHSA-jqwh-526h-c92j.
How 0Day mitigates this
kiota php code generator is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.