Laravel Framework Environment Manipulation Vulnerability - GHSA-gv7v-rgg6-548h
Summary
CVE-2024-52301: Laravel environment manipulation via query string. Affects laravel/framework across 6 version ranges.
< 6.20.45
>= 7.0.0, < 7.30.7
>= 8.0.0, < 8.83.28
>= 9.0.0, < 9.52.17
>= 10.0.0, < 10.48.23
>= 11.0.0, < 11.31.0
Fixed in 6 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- laravel · Bitnami
- php-laravel-framework · Debian:11
The same CVE-2024-52301 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Laravel is a popular open-source PHP framework designed for building web applications with an elegant syntax. It provides a robust set of tools and features, including routing, sessions, caching, and authentication, making it a preferred choice for developers. However, the framework is susceptible to a specific vulnerability that allows environment manipulation through crafted query strings when certain PHP settings are enabled.
Vulnerability Detail
The vulnerability arises when the 'register_argc_argv' PHP directive is set to 'on'. In this scenario, attackers can manipulate the environment used by the Laravel framework by crafting specific query strings in the URL. This could lead to unauthorized access or unintended behavior in the application, as the framework may process requests with altered environment settings. The issue is particularly concerning for applications that rely on environment variables for configuration, as it can compromise the integrity and security of the application.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 6.20.456.20.45composer require laravel/framework:6.20.45 -
>= 7.0.0, < 7.30.77.30.7composer require laravel/framework:7.30.7 -
>= 8.0.0, < 8.83.288.83.28composer require laravel/framework:8.83.28 -
>= 9.0.0, < 9.52.179.52.17composer require laravel/framework:9.52.17 -
>= 10.0.0, < 10.48.2310.48.23composer require laravel/framework:10.48.23 -
>= 11.0.0, < 11.31.011.31.0composer require laravel/framework:11.31.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can disable the 'register_argc_argv' directive in your PHP configuration. This can be done by modifying the php.ini file:
register_argc_argv = Off
Alternatively, ensure that your application does not rely on the argv values for environment detection in non-CLI contexts.
Conclusion
The Laravel framework has a vulnerability that allows environment manipulation through crafted query strings when the 'register_argc_argv' directive is enabled. It is crucial to update to the latest patched versions to mitigate this risk. Additionally, disabling the directive can serve as a temporary workaround while you plan for an update.
See every vulnerability recorded for laravel/framework →
FAQ
The 'register_argc_argv' directive in PHP allows the script to access command-line arguments. When enabled, it can lead to vulnerabilities if not handled properly.
If exploited, this vulnerability can allow attackers to manipulate the environment settings of your Laravel application, potentially leading to unauthorized access or application misbehavior.
The vulnerability affects Laravel versions prior to the following patched versions: 6.20.45, 7.30.7, 8.83.28, 9.52.17, 10.48.23, and 11.31.0.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can use the Vulert playground at Vulert Scanner to analyze your composer.lock file without any signup.
If immediate updates are not feasible, consider disabling the 'register_argc_argv' directive in your PHP configuration as a temporary workaround until you can apply the necessary updates.
References
Related vulnerabilities
Recent vulnerabilities recorded for laravel/framework.
