GHSA-m557-wrgg-6rp4: Server-Side Request Forgery via Authority Information Access (AIA) Chasing in phpseclib

Vulnerability ID: GHSA-M557-WRGG-6RP4
CVSS Score: 5.8
Published: 2026-06-16

The PHP Secure Communications Library (phpseclib) contains a Server-Side Request Forgery (SSRF) vulnerability due to an insecure default implementation of Authority Information Access (AIA) certificate chasing. This flaw allows remote, unauthenticated attackers to coerce applications validating user-supplied X.509 certificates into generating arbitrary outbound HTTP requests to internal networks or local interfaces.

TL;DR

An insecure default configuration in phpseclib enables dynamic retrieval of Certificate Authority certificates via Authority Information Access (AIA) extensions. Because these target URLs are extracted directly from user-supplied certificates and processed without destination validation, attackers can initiate arbitrary outbound GET requests to internal networks and cloud metadata servers.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-918
• Attack Vector: Network (AV:N)
• CVSS v3.1: 5.8
• Impact: Server-Side Request Forgery
• Exploit Status: Proof of Concept
• KEV Status: Not Listed

Affected Systems

• phpseclib/phpseclib (Packagist/Composer Package)
• phpseclib: >= 0.1.1, < 1.0.30 (Fixed in: 1.0.30)
• phpseclib: >= 2.0.0, < 2.0.55 (Fixed in: 2.0.55)
• phpseclib: >= 3.0.0, < 3.0.54 (Fixed in: 3.0.54)

Mitigation Strategies

• Upgrade phpseclib/phpseclib to a patched version (1.0.30, 2.0.55, or 3.0.54).
• Deactivate dynamic URL fetching globally using X509::disableURLFetch() if intermediate certificate chasing is not required.
• Register a secure fetch callback via X509::setURLFetchCallback() to enforce IP and domain blocklists on outbound requests.

Remediation Steps:

1. Identify all instances of phpseclib in the composer.lock file and update the package reference.
2. For temporary mitigation, append X509::disableURLFetch() immediately after initializing phpseclib classes.
3. Implement an IP validation filter inside the custom callback to block private subnets, loopback interfaces, and multicast addresses.

References

• GitHub Security Advisory GHSA-m557-wrgg-6rp4
• phpseclib Project Advisory
• phpseclib Repository
• phpseclib 3.0.54 Release Notes

Read the full report for GHSA-M557-WRGG-6RP4 on our website for more details including interactive diagrams and full exploit analysis.