Guard Bypass in Eloquent Models Affecting Laravel Illuminate Database Component
Summary
CVE-2020-24940: Guard bypass in Eloquent models affecting Laravel illuminate database component. Affects illuminate/database across 3 version ranges.
>= 5.5.0, <= 5.5.44
>= 6.0.0, < 6.18.34
>= 7.0.0, < 7.23.2
Fixed in 6.18.34 or 7.23.2, depending on the release line you run. How to fix ↓
Also tracked for
- laravel · Bitnami
The same CVE-2020-24940 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Laravel Illuminate Database component is a popular package used in Laravel applications for database management. It provides an expressive query builder, ActiveRecord implementation, and various other utilities for interacting with databases. The component is widely used in Laravel projects for efficient and secure database operations.
Vulnerability Detail
The vulnerability, identified as GHSA-c7rm-w2hj-x8g3, affects versions of Laravel before 6.18.34 and 7.x before 7.23.2. It involves the Eloquent models in the Illuminate Database component. In certain scenarios, unvalidated values are saved to the database component during mass assignment, bypassing the intended guard mechanisms. This can lead to unauthorized modifications to the database, potentially compromising the integrity and security of the application. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 6.0.0, < 6.18.346.18.34composer require illuminate/database:6.18.34 -
>= 7.0.0, < 7.23.27.23.2composer require illuminate/database:7.23.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading to the patched versions of Laravel.
Conclusion
The Guard Bypass vulnerability in Eloquent models affecting the Laravel Illuminate Database component can lead to unauthorized modifications to the database, posing a significant risk to the application's integrity and security. It is highly recommended to upgrade to the fixed versions of Laravel to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for illuminate/database →
FAQ
The vulnerability allows unvalidated values to be saved to the database component, bypassing guard mechanisms. This can lead to unauthorized modifications to the database, potentially compromising the integrity and security of the application.
Versions of Laravel before 6.18.34 and 7.x before 7.23.2 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your composer.lock file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, the fix for this vulnerability is to upgrade to Laravel version 6.18.34 or 7.23.2, depending on the Laravel version being used.
There are no known workarounds for this vulnerability. It is crucial to apply the recommended fix by upgrading to the patched versions of Laravel.
Related vulnerabilities
Recent vulnerabilities recorded for illuminate/database.
