Vulnerability · Published Dec 7, 2021 · Assigned by GitHub_M
CVE-2021-43808Blade `@parent` Exploitation Leading To Possible XSS in Laravel
Medium 5.3
In plain English
A medium-severity cross-site scripting in framework from laravel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Laravel is a web application framework. Laravel prior to versions 8.75.0, 7.30.6, and 6.20.42 contain a possible cross-site scripting (XSS) vulnerability in the Blade templating engine. A broken HTML element may be clicked and the user taken to another location in their browser due to XSS. This is due to the user being able to guess the parent placeholder SHA-1 hash by trying common names of sections. If the parent template contains an exploitable HTML structure an XSS vulnerability can be exposed. This vulnerability has been patched in versions 8.75.0, 7.30.6, and 6.20.42 by determining the parent placeholder at runtime and using a random hash that is unique to each request.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | php-laravel-framework | 6.20.14+dfsg-3 | DEBIAN-CVE-2021-43808 |
| Debian:13 | php-laravel-framework | 6.20.14+dfsg-3 | DEBIAN-CVE-2021-43808 |
| Debian:14 | php-laravel-framework | 6.20.14+dfsg-3 | DEBIAN-CVE-2021-43808 |
| Packagist | illuminate/view | 7.30.6 | GHSA-66hf-2p6w-jqfw |
| Packagist | illuminate/view | 6.20.42 | GHSA-66hf-2p6w-jqfw |
| Packagist | illuminate/view | 8.75.0 | GHSA-66hf-2p6w-jqfw |
| Packagist | laravel/framework | 6.20.42 | GHSA-66hf-2p6w-jqfw |
| Packagist | laravel/framework | 8.75.0 | GHSA-66hf-2p6w-jqfw |
| Packagist | laravel/framework | 7.30.6 | GHSA-66hf-2p6w-jqfw |
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
References
- https://github.com/laravel/framework/security/advisories/GHSA-66hf-2p6w-jqfw x_refsource_CONFIRM
- https://github.com/laravel/framework/pull/39906 x_refsource_MISC
- https://github.com/laravel/framework/pull/39908 x_refsource_MISC
- https://github.com/laravel/framework/pull/39909 x_refsource_MISC
- https://github.com/laravel/framework/commit/b8174169b1807f36de1837751599e2828ceddb9b x_refsource_MISC
- https://github.com/laravel/framework/releases/tag/v6.20.42 x_refsource_MISC
- https://github.com/laravel/framework/releases/tag/v7.30.6 x_refsource_MISC
- https://github.com/laravel/framework/releases/tag/v8.75.0 x_refsource_MISC