Vulnerability · Published Nov 12, 2024 · Assigned by GitHub_M
CVE-2024-52301Laravel allows environment manipulation via query string
High 8.7
In plain English
A high-severity argument injection in framework from laravel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 44.8% (higher than 99% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
Laravel is a web application framework. When the register_argc_argv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling the request. The vulnerability fixed in 6.20.45, 7.30.7, 8.83.28, 9.52.17, 10.48.23, and 11.31.0. The framework now ignores argv values for environment detection on non-cli SAPIs.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | php-laravel-framework | no fix listed | DEBIAN-CVE-2024-52301 |
| Debian:13 | php-laravel-framework | 10.48.25+dfsg-1 | DEBIAN-CVE-2024-52301 |
| Debian:14 | php-laravel-framework | 10.48.25+dfsg-1 | DEBIAN-CVE-2024-52301 |
| Packagist | laravel/framework | 9.52.17 | GHSA-gv7v-rgg6-548h |
| Packagist | laravel/framework | 6.20.45 | GHSA-gv7v-rgg6-548h |
| Packagist | laravel/framework | 11.31.0 | GHSA-gv7v-rgg6-548h |
| Packagist | laravel/framework | 10.48.23 | GHSA-gv7v-rgg6-548h |
| Packagist | laravel/framework | 7.30.7 | GHSA-gv7v-rgg6-548h |
| Packagist | laravel/framework | 8.83.28 | GHSA-gv7v-rgg6-548h |
Affected products (as reported)
Weakness: CWE-88 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N