Impact

This vulnerability allows attackers to execute arbitrary code when you use Validation Placeholders.

The vulnerability exists in the Validation library, and validation methods in the controller and in-model validation are also vulnerable because they use the Validation library internally.

Patches

Upgrade to v4.3.5 or later.

Workarounds

Setting validation rules with an array.

E.g.:

$validation->setRules([
    'email' => ['required', 'valid_email, 'is_unique[users.email,id,{id}]'],
]);

References

• https://codeigniter4.github.io/userguide/libraries/validation.html#validation-placeholders
• https://codeigniter4.github.io/userguide/incoming/controllers.html#validating-data
• https://codeigniter4.github.io/userguide/models/model.html#in-model-validation

For more information

If you have any questions or comments about this advisory:

• Open an issue in codeigniter4/CodeIgniter4
• Email us at SECURITY.md

References

• GHSA-m6m8-6gq8-c9fj
• codeigniter4/CodeIgniter4@6af6771
• https://github.com/codeigniter4/CodeIgniter4/blob/develop/CHANGELOG.md#v435-2023-05-21
• https://nvd.nist.gov/vuln/detail/CVE-2023-32692
• https://github.com/codeigniter4/CodeIgniter4/blob/develop/CHANGELOG.md