CVE-2024-52301 Laravel allows environment manipulation via query string

High 8.7 Published 12 Nov 2024 Updated 21 Dec 2024

Attackers can manipulate the application environment via query strings when register_argc_argv is enabled, bypassing intended configuration settings.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2024-52301?

CVE-2024-52301 is a high-severity vulnerability in Debian Debian Linux, published on 12 Nov 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Laravel is a web application framework. When the register_argc_argv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling the request. The vulnerability fixed in 6.20.45, 7.30.7, 8.83.28, 9.52.17, 10.48.23, and 11.31.0. The framework now ignores argv values for environment detection on non-cli SAPIs.

Weakness: CWE-88

Which versions are affected by CVE-2024-52301?

13 open source packages ship an affected version, including laravel/framework and laravel. It affects 2 products.

Package	Affected	Fixed in
`laravel/framework` Packagist	All versions	`6.20.45`
`laravel/framework` Packagist	All versions	`6.20.45`
`laravel/framework` Packagist	From `10.0.0`	`10.48.23`
`laravel/framework` Packagist	From `10.0.0`	`10.48.23`
`laravel/framework` Packagist	From `11.0.0`	`11.31.0`
`laravel/framework` Packagist	From `11.0.0`	`11.31.0`

7 more packages

`laravel/framework` Packagist	From `7.0.0`	`7.30.7`
`laravel/framework` Packagist	From `7.0.0`	`7.30.7`
`laravel/framework` Packagist	From `8.0.0`	`8.83.28`
`laravel/framework` Packagist	From `8.0.0`	`8.83.28`
`laravel/framework` Packagist	From `9.0.0`	`9.52.17`
`laravel/framework` Packagist	From `9.0.0`	`9.52.17`
`laravel` Bitnami	All versions	`6.20.45, 7.30.7, 8.83.28, 9.52.17, 10.48.23, 11.31.0`

Products include Debian Debian Linux, Laravel Framework.

How do I fix CVE-2024-52301?

Upgrade laravel/framework to a fixed version for your release line: 6.20.45, 10.48.23, 11.31.0 or 7.30.7.

Is CVE-2024-52301 being exploited?

There is no known exploitation of CVE-2024-52301 in the wild and no public exploit code.

Public exploit code: 3 proofs of concept on GitHub.

All Debian Debian Linux vulnerabilities

Sources

Also known as BIT-laravel-2024-52301, DEBIAN-CVE-2024-52301, DLA-3997-1, GHSA-gv7v-rgg6-548h.