CVE-2016-7130 in PHP
Summary
by MITRE
The php_wddx_pop_element function in ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly have unspecified other impact via an invalid base64 binary value, as demonstrated by a wddx_deserialize call that mishandles a binary element in a wddxPacket XML document.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/15/2022
The vulnerability identified as CVE-2016-7130 represents a critical NULL pointer dereference flaw within the PHP WDDX (Web Distributed Data Exchange) extension, specifically affecting the php_wddx_pop_element function in the ext/wddx/wddx.c file. This vulnerability impacts PHP versions prior to 5.6.25 and 7.x versions prior to 7.0.10, creating a significant risk for web applications that utilize WDDX serialization and deserialization capabilities. The flaw manifests when processing invalid base64 binary values within WDDX packet XML documents, particularly during wddx_deserialize operations that encounter malformed binary elements.
The technical exploitation of this vulnerability occurs through manipulation of WDDX XML packet structures containing malformed binary data. When PHP attempts to deserialize such packets using the wddx_deserialize function, the php_wddx_pop_element function fails to properly validate the base64 binary content, leading to a NULL pointer dereference condition. This condition causes the PHP application to crash abruptly, resulting in a denial of service scenario that can be exploited remotely by attackers. The vulnerability stems from inadequate input validation and error handling within the WDDX parsing logic, where the function does not properly check for null references before attempting to access memory locations.
The operational impact of CVE-2016-7130 extends beyond simple denial of service, as the vulnerability may potentially enable more severe consequences including arbitrary code execution or information disclosure depending on the execution environment. Web applications relying on WDDX for data exchange between systems become vulnerable to remote exploitation, particularly those that process untrusted XML data from external sources. Attackers can craft malicious WDDX packets containing invalid base64 binary values that, when processed by vulnerable PHP applications, trigger the NULL pointer dereference and subsequent application crash. This vulnerability particularly affects web services, APIs, and applications that deserialize user-provided WDDX data without proper sanitization.
Security professionals should note that this vulnerability aligns with CWE-476, which specifically addresses NULL pointer dereference conditions in software implementations. The attack vector follows patterns consistent with ATT&CK technique T1203, where adversaries exploit software vulnerabilities to cause system instability or denial of service. Organizations should prioritize immediate patching of affected PHP versions to prevent exploitation, while implementing additional defensive measures such as input validation for all WDDX data, network segmentation to limit exposure, and monitoring for unusual application crash patterns. The vulnerability demonstrates the importance of proper error handling in XML parsing libraries and highlights the need for comprehensive testing of edge cases in data serialization functions that may be exposed to untrusted input sources.