CRLF Injection Vulnerability in Laravel Framework: Impacting Email Processing
Summary
GHSA-5vg9-5847-vvmq: Laravel Framework: CRLF injection in default email rule. Affects laravel/framework across 2 version ranges.
< 12.60.0
>= 13.0.0, < 13.10.0
Fixed in 12.60.0 or 13.10.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Laravel is a popular open-source PHP framework designed for web application development. It provides a robust set of tools and features, including routing, authentication, and email handling. However, a recent vulnerability has been identified in its email validation process, which can lead to serious security issues if user-supplied email addresses are not properly sanitized.
Vulnerability Detail
A CRLF (Carriage Return Line Feed) injection vulnerability exists in Laravel's email validation mechanism. This flaw, when exploited, allows an unauthenticated attacker to manipulate outbound email content by supplying specially crafted email addresses. This can lead to unauthorized access, mail relay abuse, and unintended email delivery, potentially compromising sensitive information and disrupting application functionality.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 12.60.012.60.0composer require laravel/framework:12.60.0 -
>= 13.0.0, < 13.10.013.10.0composer require laravel/framework:13.10.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that any user-supplied email addresses are thoroughly validated and sanitized before processing. Implement additional checks to reject any email addresses containing CRLF sequences. For example, you can use a regex pattern to filter out such inputs:
if (preg_match('/[\r\n]/', $userInputEmail)) {
// Reject the email address
}
Conclusion
The CRLF injection vulnerability in the Laravel Framework poses significant risks to applications that handle user-supplied email addresses. It is crucial to upgrade to the latest patched versions to mitigate these risks. Additionally, implementing proper input validation can help protect against such vulnerabilities.
See every vulnerability recorded for laravel/framework →
FAQ
CRLF injection is a type of attack where an attacker injects carriage return and line feed characters into an input field, potentially altering the way data is processed or displayed.
If exploited, this vulnerability can lead to unauthorized email content manipulation, unintended email delivery, and potential data breaches.
Laravel versions 0 to 13.9.0 are affected by this vulnerability. Ensure to upgrade to 12.60.0 or later, or 13.10.0 or later.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup.
The CVSS score of this vulnerability is 8.9, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for laravel/framework.
