Vulnerability · Published Nov 14, 2021 · Assigned by mitre
CVE-2021-43617
Critical 9.8
In plain English
A critical-severity security flaw in the php-laravel-framework package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 20.0% (higher than 97% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for .phar files, which are handled as application/x-httpd-php on systems based on Debian. NOTE: this CVE Record is for Laravel Framework, and is unrelated to any reports concerning incorrectly written user applications for image upload.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | php-laravel-framework | 6.20.14+dfsg-3 | DEBIAN-CVE-2021-43617 |
| Debian:13 | php-laravel-framework | 6.20.14+dfsg-3 | DEBIAN-CVE-2021-43617 |
| Debian:14 | php-laravel-framework | 6.20.14+dfsg-3 | DEBIAN-CVE-2021-43617 |
| Packagist | laravel/framework | no fix listed | GHSA-364w-9g92-3grq |
Affected products (as reported)
References
- https://github.com/laravel/framework/blob/2049de73aa099a113a287587df4cc522c90961f5/src/Illuminate/Validation/Concerns/ValidatesAttributes.php#L1331-L1333 x_refsource_MISC
- https://salsa.debian.org/php-team/php/-/commit/dc253886b5b2e9bc8d9e36db787abb083a667fd8 x_refsource_MISC
- https://salsa.debian.org/php-team/php/-/blob/dc253886b5b2e9bc8d9e36db787abb083a667fd8/debian/php-cgi.conf#L5-6 x_refsource_MISC