CVE-2024-13919: Laravel Framework Reflected Cross-Site Scripting Vulnerability
Summary
CVE-2024-13919: Laravel framework susceptible to reflected cross-site scripting. Affects laravel/framework versions >= 11.9.0, < 11.36.0. Fixed in 11.36.0. How to fix ↓
Also tracked for
- php-laravel-framework · Debian:11
The same CVE-2024-13919 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Laravel is a popular open-source PHP framework designed for web application development. It provides a robust set of tools and features for building modern web applications, including routing, authentication, and templating. However, certain versions of Laravel are susceptible to a reflected cross-site scripting vulnerability, which can compromise the security of applications built on this framework.
Vulnerability Detail
The vulnerability arises from improper encoding of route parameters in the debug-mode error page of Laravel versions 11.9.0 to 11.35.1. This flaw allows attackers to inject malicious scripts into the error page, which can then be executed in the context of the user's browser. As a result, sensitive information may be exposed, and users could be redirected to malicious sites. The potential ramifications include data theft, session hijacking, and overall compromise of user trust.
How To Fix
Minimum fixed version
11.36.0
This is the first release that contains the fix.
composer require laravel/framework:11.36.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider disabling debug mode in your application to mitigate the risk. You can do this by setting the APP_DEBUG environment variable to false in your .env file:
APP_DEBUG=false
This will prevent the debug-mode error page from being displayed, thereby reducing the risk of exploitation.
Conclusion
The Laravel framework versions 11.9.0 to 11.35.1 are vulnerable to a reflected cross-site scripting issue due to improper encoding of route parameters. It is crucial to update to version 11.36.0 or later to mitigate this risk. Additionally, disabling debug mode can serve as a temporary workaround.
See every vulnerability recorded for laravel/framework →
FAQ
Reflected cross-site scripting (XSS) is a type of security vulnerability that allows an attacker to inject malicious scripts into web pages viewed by other users. It typically occurs when user input is not properly sanitized.
You can use Vulert, a tool that monitors and alerts for open-source vulnerabilities in your software. By uploading your composer.lock file to Vulert's playground, you can check if your application is affected by this vulnerability.
If exploited, this vulnerability can lead to data theft, session hijacking, and unauthorized actions performed on behalf of users, compromising the security and integrity of your application.
Yes, you can temporarily mitigate the risk by disabling debug mode in your Laravel application, which prevents the display of the debug-mode error page.
The CVSS score of this vulnerability is 4.7, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for laravel/framework.
