Laravel Encrypter Failure to Decryption Vulnerability in illuminate/encryption
Summary
GHSA-6wjw-qf87-fv5v: Laravel Encrypter Failure to decryption vulnerability. Affects illuminate/encryption across 2 version ranges.
>= 5.5.0, < 5.5.40
>= 5.6.0, < 5.6.15
Fixed in 5.5.40 or 5.6.15, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The illuminate/encryption package is a component of the Laravel framework that provides encryption and decryption functionality. It is used to securely store and transmit sensitive data within Laravel applications. However, a vulnerability has been discovered in the Encrypter component of this package, which may cause the decryption process to fail and return false instead of the expected decrypted value.
Vulnerability Detail
The vulnerability arises when an attacker is able to modify the encrypted payload before it is decrypted. This can lead to unexpected behavior when combined with weak type comparisons in the application's code. For example, if the decrypted value is compared to an empty string using a weak type comparison (==), the code may be executed even though the decrypted value is false. This can potentially result in security vulnerabilities or incorrect application behavior.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 5.5.0, < 5.5.405.5.40composer require illuminate/encryption:5.5.40 -
>= 5.6.0, < 5.6.155.6.15composer require illuminate/encryption:5.6.15
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating the package is not immediately feasible, a workaround can be implemented by using a strong type comparison (===) instead of a weak type comparison (==) when comparing the decrypted value. This ensures that the code is only executed when the decrypted value is not false. For example:
<?php
$decryptedValue = decrypt($secret);
if ($decryptedValue === '') {
// Code is not executed when decrypted value is false
}
Conclusion
The Laravel Encrypter Failure to Decryption vulnerability in the illuminate/encryption package can lead to unexpected behavior and potential security vulnerabilities. It is recommended to update the package to a fixed version or implement the provided workaround. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for illuminate/encryption →
FAQ
The impact of this vulnerability depends on the specific code within the application. If weak type comparisons are used in combination with the Laravel Encrypter, it can lead to unexpected behavior and potential security vulnerabilities.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your composer.lock file and Vulert will analyze it for any open-source vulnerabilities, including this Laravel Encrypter vulnerability.
No, not all versions of the illuminate/encryption package are affected. The vulnerability exists in versions 5.5.0 to 5.5.40 and 5.6.0 to 5.6.15. It is recommended to update to a fixed version to mitigate the vulnerability.
There is a potential exploit of this vulnerability if the attacker is able to modify the encrypted payload before it is decrypted. However, the impact of the exploit depends on the code within the application and the presence of weak type comparisons.
Yes, a patch has been released to address this vulnerability. Updating the illuminate/encryption package to version 5.5.40 or 5.6.15 will fix the vulnerability.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
