CVE-2023-36825 Orchid Deserialization of Untrusted Data vulnerability leads to Remote Code Execution
Attackers can achieve remote code execution by sending malicious data in the _state query parameter of the Orchid Laravel package.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-36825?
CVE-2023-36825 is a critical unsafe deserialization vulnerability in orchidsoftware platform, published on 11 Jul 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Orchid is a Laravel package that allows application development of back-office applications, admin/user panels, and dashboards. A vulnerability present starting in version 14.0.0-alpha4 and prior to version 14.5.0 is related to the deserialization of untrusted data from the `_state` query parameter, which can result in remote code execution. The issue has been addressed in version 14.5.0. Users are advised to upgrade their software to this version or any subsequent versions that include the patch. There are no known workarounds.
Weakness: CWE-502
Which versions are affected by CVE-2023-36825?
2 open source packages ship an affected version, including orchid/platform. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
orchid/platform Packagist | From 14.0.0-alpha4 | 14.5.0 |
orchid/platform Packagist | From 14.0.0-alpha4 | 14.5.0 |
Products include Orchid Platform.
How do I fix CVE-2023-36825?
Upgrade orchid/platform to 14.5.0 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2023-36825 being exploited?
There is no known exploitation of CVE-2023-36825 in the wild and no public exploit code.
Other vulnerabilities in orchidsoftware platform
Sources
Also known as GHSA-ph6g-p72v-pc3p.