Laravel Hijacked Authentication Cookies Vulnerability in laravel/framework
Summary
GHSA-p62r-7637-3wwc: Laravel Hijacked authentication cookies vulnerability. Affects laravel/framework versions >= 4.0.0, < 4.1.26. Fixed in 4.1.26. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
laravel/framework is a popular PHP framework that provides a robust set of tools and features for building web applications. It includes a built-in authentication system that allows users to securely log in and manage their accounts. However, prior to version 4.1.26, there was a vulnerability in the handling of "remember me" cookies. If a malicious user hijacked a remember cookie, it would remain valid for an extended period of time, even after the legitimate user reset their password or logged out. This posed a significant security risk as an attacker could gain unauthorized access to an account and perform malicious actions.
Vulnerability Detail
The vulnerability in laravel/framework allowed for the hijacking of authentication cookies. This means that if an attacker managed to obtain a user's remember cookie, they could use it to gain unauthorized access to the user's account, even after the user had taken steps to secure their account, such as resetting their password or logging out. This vulnerability was addressed in version 4.1.26 of laravel/framework by introducing security improvements for remember me cookies. After the update, a fresh token is assigned to the user each time they log in, and the token is also refreshed when the user logs out. This effectively invalidates any hijacked remember cookies.
How To Fix
Minimum fixed version
4.1.26
This is the first release that contains the fix.
composer require laravel/framework:4.1.26Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The Laravel Hijacked Authentication Cookies Vulnerability in laravel/framework allowed for the hijacking of remember cookies, enabling unauthorized access to user accounts. This vulnerability was addressed in version 4.1.26 by introducing security improvements. To fix this vulnerability, it is recommended to upgrade to the fixed version and add the 'remember_token' column to the user database table. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for laravel/framework →
FAQ
This vulnerability allows an attacker to hijack authentication cookies and gain unauthorized access to user accounts. It poses a significant security risk as an attacker could perform malicious actions on behalf of the legitimate user.
The recommended solution is to upgrade to version 4.1.26 or later of laravel/framework and add the 'remember_token' column to the user database table. These changes will invalidate hijacked remember cookies and enhance the security of user accounts.
There are no known workarounds for this vulnerability. Upgrading to the fixed version and implementing the recommended changes is the best course of action.
Yes, this vulnerability can be exploited remotely. If an attacker manages to obtain a user's remember cookie, they can use it to gain unauthorized access to the user's account.
Yes, this vulnerability has been addressed in version 4.1.26 of laravel/framework. It introduced security improvements for remember me cookies, invalidating hijacked cookies upon logout.
References
Related vulnerabilities
Recent vulnerabilities recorded for laravel/framework.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
