Laravel RCE Vulnerability in "cookie" Session Driver
Summary
GHSA-qm5c-m76r-2hfr: Laravel RCE vulnerability in "cookie" session driver. Affects laravel/framework across 2 version ranges.
>= 4.1.0, < 6.18.31
>= 7.0.0, < 7.22.4
Fixed in 6.18.31 or 7.22.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Laravel is a popular PHP framework known for its elegant syntax and powerful features. It provides developers with a robust set of tools and libraries to build web applications efficiently. One of the key components of Laravel is its session management system, which allows applications to store and retrieve user-specific data across multiple requests. The session driver determines how session data is stored and managed. The "cookie" session driver, in particular, utilizes encrypted cookies to store session information on the client-side. However, a vulnerability has been discovered in this driver that exposes an encryption oracle when combined with applications that expose arbitrary user input. This vulnerability allows attackers to execute remote code on affected systems.
Vulnerability Detail
Applications using the "cookie" session driver that also expose an encryption oracle via their application are vulnerable to remote code execution. An encryption oracle is a mechanism where arbitrary user input is encrypted, and the encrypted string is later displayed or exposed to the user. In this case, the combination of the "cookie" session driver and the encryption oracle allows users to generate valid Laravel signed encryption strings for any plain-text string. This enables them to craft Laravel session payloads, leading to potential remote code execution. The vulnerability affects Laravel versions 4.1.0 to 6.18.31 and 7.0.0 to 7.22.4.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.1.0, < 6.18.316.18.31composer require laravel/framework:6.18.31 -
>= 7.0.0, < 7.22.47.22.4composer require laravel/framework:7.22.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not possible, a temporary workaround can be implemented by switching the session driver from "cookie" to a more secure option, such as the "file" or "database" driver. This can be done by modifying the config/session.php file in the Laravel project. For example, to switch to the "file" driver, the following code can be added to the file:
'session' => [
'driver' => 'file',
// Other configuration options
],
It is important to note that this workaround may impact the functionality or performance of the application, and upgrading to the latest Laravel version is still recommended.
Conclusion
The Laravel RCE vulnerability in the "cookie" session driver exposes an encryption oracle, allowing attackers to execute remote code on affected systems. To mitigate this vulnerability, it is crucial to update Laravel to the latest version available. If immediate upgrading is not possible, switching to a more secure session driver can serve as a temporary workaround. It is essential to prioritize the security of your Laravel applications and take necessary steps to protect against potential remote code execution.
See every vulnerability recorded for laravel/framework →
FAQ
The vulnerability allows attackers to execute remote code on affected systems, potentially leading to unauthorized access, data breaches, or complete system compromise.
The vulnerability affects Laravel versions 4.1.0 to 6.18.31 and 7.0.0 to 7.22.4.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your composer.lock file to the playground, and it will analyze the dependencies and alert you if any vulnerabilities are found.
At the time of this advisory, no known exploits for this vulnerability have been reported. However, it is crucial to patch the vulnerability as soon as possible to prevent potential attacks.
For further support on vulnerability remediation or any other security concerns, you can reach out to info@devnack.com. Our team of experts will be happy to assist you.
References
Related vulnerabilities
Recent vulnerabilities recorded for laravel/framework.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
