Laravel RCE vulnerability in "cookie" session driver
Summary
GHSA-2ffv-r4r9-r8xr: Laravel RCE vulnerability in "cookie" session driver. Affects illuminate/cookie across 2 version ranges.
>= 4.1.0, < 6.18.31
>= 7.0.0, < 7.22.4
Fixed in 6.18.31 or 7.22.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Laravel framework is a popular PHP framework used for web application development. One of its key components is the "cookie" session driver, which allows applications to store session data in encrypted cookies. This driver is commonly used in Laravel applications for its simplicity and ease of implementation. However, a vulnerability has been discovered in the "cookie" session driver that could potentially lead to remote code execution.
Vulnerability Detail
Applications using the "cookie" session driver in Laravel 5.5 and earlier versions, along with an exposed encryption oracle, are vulnerable to remote code execution. An encryption oracle is a mechanism where user input is encrypted and the encrypted string is later displayed or exposed to the user. This combination of scenarios allows an attacker to generate valid Laravel signed encryption strings for any plain-text string, enabling them to craft malicious Laravel session payloads. This vulnerability poses a significant risk to the security and integrity of affected applications.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.1.0, < 6.18.316.18.31composer require illuminate/cookie:6.18.31 -
>= 7.0.0, < 7.22.47.22.4composer require illuminate/cookie:7.22.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the recommended versions is not immediately feasible, a temporary workaround is to switch from the "cookie" session driver to an alternative driver, such as the "file" or "database" driver. This can be done by modifying the Laravel configuration file (config/session.php) and changing the value of the 'driver' option to 'file' or 'database'. However, it is important to note that this workaround may have implications on the performance and functionality of the application.
Conclusion
The Laravel RCE vulnerability in the "cookie" session driver is a critical security issue that affects Laravel 5.5 and earlier versions. It allows attackers to execute remote code by exploiting an exposed encryption oracle. It is crucial to upgrade to the recommended Laravel versions or apply the provided workaround to mitigate the risk. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for illuminate/cookie →
FAQ
Laravel 5.5 and earlier versions are affected by this vulnerability.
An encryption oracle is a mechanism where arbitrary user input is encrypted and the encrypted string is later displayed or exposed to the user.
By leveraging an exposed encryption oracle, an attacker can generate valid Laravel signed encryption strings for any plain-text string, allowing them to craft malicious Laravel session payloads.
The recommended fix is to upgrade to Laravel version 6.18.31 or later for Laravel 5.x applications, and version 7.22.4 or later for Laravel 7.x applications.
A temporary workaround is to switch from the "cookie" session driver to an alternative driver, such as the "file" or "database" driver.
References
Related vulnerabilities
Recent vulnerabilities recorded for illuminate/cookie.
