CVE-2017-5630 in PHP PEAR
Summary
by MITRE
PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenames after a redirect, which allows remote HTTP servers to overwrite files via crafted responses, as demonstrated by a .htaccess overwrite.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/15/2025
The vulnerability identified as CVE-2017-5630 resides within the PEAR Base System version 1.10.1, specifically within the Installer component's download utility class. This flaw represents a critical security oversight that enables remote attackers to manipulate file operations through improper validation mechanisms. The vulnerability manifests when the system processes HTTP redirects without adequately validating the file types and names of resources being downloaded, creating an avenue for malicious file overwrites.
The technical implementation of this vulnerability stems from insufficient input validation within the Installer's download utility class. When a remote HTTP server responds to a download request, the system fails to properly sanitize or validate the filename and file type information contained in the response headers. This allows an attacker controlling the remote server to craft malicious responses that specify arbitrary filenames, including sensitive system files such as .htaccess. The vulnerability specifically exploits the lack of proper validation after redirect processing, enabling attackers to bypass normal file handling security checks that should prevent overwriting critical system configuration files.
From an operational impact perspective, this vulnerability presents a significant risk to systems utilizing PEAR Base System version 1.10.1. The ability to overwrite .htaccess files provides attackers with potential access to web server configuration directives, which could lead to further compromise of web applications hosted on the system. The exploitation scenario demonstrates how attackers can leverage this flaw to modify critical configuration files that control web server behavior, potentially enabling them to execute arbitrary code, modify access controls, or redirect traffic to malicious endpoints. This represents a direct violation of the principle of least privilege and could result in complete system compromise.
The vulnerability aligns with CWE-22, which addresses improper limitation of a pathname to a restricted directory, and CWE-73, which covers external control of filename or path. It also maps to ATT&CK technique T1059.007, which involves the execution of malicious code through web shells or compromised web server configurations. The attack vector requires an attacker to control a remote HTTP server that can be reached by the vulnerable PEAR system during the download process, making it particularly dangerous in environments where external connectivity is permitted or where the system might interact with untrusted sources.
Mitigation strategies for CVE-2017-5630 should focus on immediate patching of the PEAR Base System to version 1.10.2 or later, which contains the necessary fixes for the download utility validation. Organizations should implement network-level controls to restrict outbound HTTP connections from systems running PEAR, particularly to untrusted domains. Additionally, administrators should consider implementing file access controls and monitoring mechanisms to detect unauthorized modifications to critical system files like .htaccess. The implementation of strict input validation and sanitization for all file operations, combined with regular security audits of installed packages, will help prevent similar vulnerabilities from being exploited in the future.