search

zendesk / zendesk_api_client_php

Official Zendesk API v2 client library for PHP
336 stars 259 forks source link

Security issue in oauth sample #464

Closed johan-lindahl closed 2 years ago

johan-lindahl commented 3 years ago

The oauth sample seems to be vulnerable to deserialization attacks.

https://github.com/zendesk/zendesk_api_client_php/blob/13f0c1f299796cc271a2b84c7eda98b3ab0c97a9/samples/auth/oauth.php#L28

https://owasp.org/www-community/vulnerabilities/PHP_Object_Injection

mattkennedy-zendesk commented 2 years ago

Hi @johan-lindahl,

Thanks for making us aware of this, and our apologies for the delay in responding to it. We have now fixed this issue, and have also published an advisory with some more information.

Please let us know if you have any questions.

Matt.