Laravel Hijacked authentication cookies vulnerability in illuminate/auth
Summary
GHSA-q4xf-7fw5-4x8v: Laravel Hijacked authentication cookies vulnerability. Affects illuminate/auth versions >= 4.0.0, < 4.1.26. Fixed in 4.1.26. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
illuminate/auth is a package in the Packagist ecosystem that provides authentication services for Laravel applications. It is responsible for managing user authentication, including the generation and validation of authentication cookies. This vulnerability affects versions prior to 4.1.26 of the package. Prior to this update, if a remember cookie was hijacked by a malicious user, it would remain valid for an extended period of time, even after the true owner of the account reset their password or logged out. This could lead to unauthorized access and potential compromise of user accounts.
Vulnerability Detail
The Laravel Hijacked authentication cookies vulnerability allows an attacker to hijack a user's authentication cookie and gain unauthorized access to their account. This vulnerability arises from the lack of token refreshment in the remember me functionality. Before the fix, if a remember me cookie was stolen, it would remain valid indefinitely, even after the user changed their password or logged out. The fix introduced a new remember_token column in the users database table. Each time a user logs in, a fresh token is assigned, and the token is also refreshed upon logout. This ensures that even if a remember me cookie is hijacked, simply logging out of the application will invalidate the cookie, preventing unauthorized access.
How To Fix
Minimum fixed version
4.1.26
This is the first release that contains the fix.
composer require illuminate/auth:4.1.26Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround for this vulnerability. Upgrading the package and implementing the necessary database migration is the recommended solution.
Conclusion
The Laravel Hijacked authentication cookies vulnerability in the illuminate/auth package allows an attacker to hijack user authentication cookies and gain unauthorized access to user accounts. This vulnerability has been addressed in version 4.1.26 of the package by introducing a new remember_token column and refreshing the token upon login and logout. Upgrading the package and implementing the necessary database migration is crucial to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for illuminate/auth →
FAQ
This vulnerability allows an attacker to hijack a user's authentication cookie and gain unauthorized access to their account. It can lead to unauthorized actions on behalf of the user, exposure of sensitive information, and potential compromise of user accounts.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the composer.lock file.
There is no known public exploit for this vulnerability at the time of writing. However, it is important to promptly address and fix the vulnerability to prevent any potential exploitation.
This vulnerability specifically affects the illuminate/auth package in Laravel. However, it is always recommended to keep all dependencies up to date to ensure the overall security of your application.
For further support on vulnerability remediation, you can reach out to info@devnack.com. They can provide guidance and assistance in addressing this vulnerability.
