CVE-2020-24940: Laravel Mass Assignment Unvalidated Values Database Vulnerability
Summary
CVE-2020-24940: An issue was discovered in Laravel before 6.18.34 and 7.x before 7.23.2. Affects laravel across 2 version ranges.
< 6.18.34
>= 7.0.0, < 7.23.2
Fixed in 6.18.34 or 7.23.2, depending on the release line you run. How to fix ↓
Also tracked for
- illuminate/database · Packagist
The same CVE-2020-24940 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Laravel is an open-source PHP web framework used for developing web applications. It provides a clean and elegant syntax while offering a range of features for web development. Laravel is vulnerable to a mass assignment issue, which occurs when unvalidated values are saved to the database in certain situations where table names are stripped during a mass assignment.
Vulnerability Detail
The vulnerability in Laravel allows unvalidated values to be saved to the database during a mass assignment process. This occurs when table names are stripped, leading to the insertion of potentially malicious or unintended data. The impact of this vulnerability can be severe, as it can result in unauthorized data modifications, data leakage, or even remote code execution. It is important to note that this vulnerability affects Laravel versions before 6.18.34 and 7.x before 7.23.2.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 6.18.346.18.34 -
>= 7.0.0, < 7.23.27.23.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, developers can manually validate and sanitize input values before saving them to the database. This can be achieved by implementing proper input validation and using Laravel's built-in validation mechanisms. By validating and sanitizing user input, the risk of unvalidated values being saved to the database can be mitigated. Here is an example of how to validate input using Laravel's validation rules:
$request->validate([
'field_name' => 'required|string',
]);
By specifying the required validation rule and appropriate data type, developers can ensure that only validated and sanitized values are saved to the database.
Conclusion
In conclusion, the Laravel framework is vulnerable to a mass assignment issue that allows unvalidated values to be saved to the database. This can lead to unauthorized data modifications, data leakage, or even remote code execution. It is crucial to update Laravel to the recommended versions and regularly update dependencies to mitigate the risk of known vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for laravel →
FAQ
Laravel is an open-source PHP web framework used for developing web applications. It provides a clean and elegant syntax while offering a range of features for web development.
Mass assignment is a feature in Laravel that allows developers to assign multiple attributes to a model at once. However, if not properly validated, it can lead to security vulnerabilities.
The vulnerability can result in unauthorized data modifications, data leakage, or even remote code execution. It is crucial to address this vulnerability to prevent potential security breaches.
To fix this vulnerability, it is recommended to update Laravel to version 6.18.34 or later for Laravel 6.x, and version 7.23.2 or later for Laravel 7.x. Regularly updating Laravel and other dependencies is crucial to mitigate the risk of known vulnerabilities.
As a temporary workaround, developers can manually validate and sanitize input values before saving them to the database. By implementing proper input validation and using Laravel's built-in validation mechanisms, the risk of unvalidated values being saved to the database can be mitigated.
References
Related vulnerabilities
Recent vulnerabilities recorded for laravel.
