CVE-2024-13918: Laravel Framework Reflected Cross-Site Scripting Vulnerability
Summary
CVE-2024-13918: Laravel framework susceptible to reflected cross-site scripting. Affects laravel/framework versions >= 11.9.0, < 11.36.0. Fixed in 11.36.0. How to fix ↓
Also tracked for
- php-laravel-framework · Debian:11
The same CVE-2024-13918 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Laravel framework is a popular open-source PHP framework designed for building web applications with an elegant syntax. It provides a robust set of tools and features, including routing, authentication, and templating, which streamline the development process. However, versions 11.9.0 to 11.35.1 are vulnerable to a reflected cross-site scripting (XSS) issue, which can compromise the security of applications built using this framework.
Vulnerability Detail
The vulnerability arises from improper encoding of request parameters in the debug-mode error page of the Laravel framework. When an application encounters an error, it may display sensitive information, including user input, without proper sanitization. This allows attackers to inject malicious scripts into the error page, which can be executed in the context of the user's browser, leading to potential data theft or session hijacking. The affected versions are between 11.9.0 and 11.35.1, and the vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).
How To Fix
Minimum fixed version
11.36.0
This is the first release that contains the fix.
composer require laravel/framework:11.36.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider disabling debug mode in your application by setting 'APP_DEBUG=false' in your .env file. This will prevent the debug error page from being displayed, thus mitigating the risk of XSS attacks until you can apply the patch.
Conclusion
The Laravel framework versions 11.9.0 to 11.35.1 are vulnerable to a reflected cross-site scripting issue due to improper encoding of request parameters. It is crucial to update to version 11.36.0 or later to mitigate this risk. Additionally, disabling debug mode can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for laravel/framework →
FAQ
Reflected cross-site scripting (XSS) is a type of security vulnerability where an attacker injects malicious scripts into a web application, which are then executed in the user's browser. This can lead to unauthorized access to sensitive information.
You can use Vulert, a tool that monitors open-source vulnerabilities in your software. By analyzing your composer.lock file, Vulert can alert you in real-time about any vulnerabilities, including CVE-2024-13918.
If exploited, this vulnerability can allow attackers to execute arbitrary scripts in the context of the user's session, potentially leading to data theft, session hijacking, or other malicious activities.
Yes, you can temporarily mitigate the risk by disabling debug mode in your application. Set 'APP_DEBUG=false' in your .env file to prevent the display of debug error pages.
The CVSS score for this vulnerability is 4.7, indicating a moderate level of risk associated with its exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for laravel/framework.
