GHSA-2ffv-r4r9-r8xr Laravel RCE vulnerability in "cookie" session driver
Attackers can achieve remote code execution in Laravel apps using the cookie session driver if an encryption oracle is exposed.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-2ffv-r4r9-r8xr?
GHSA-2ffv-r4r9-r8xr is a code injection vulnerability in illuminate/cookie, published on 15 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Application's using the "cookie" session driver were the primary applications affected by this vulnerability. Since we have not yet released a security release for the Laravel 5.5 version of the framework, we recommend that all applications running Laravel 5.5 and earlier do not use the "cookie" session driver in their production deployments.
Regarding the vulnerability, applications using the "cookie" session driver that were also exposing an encryption oracle via their application were vulnerable to remote code execution. An encryption oracle is a mechanism where arbitrary user input is encrypted and the encrypted string is later displayed or exposed to the user. This combination of scenarios lets the user generate valid Laravel signed encryption strings for any plain-text string, thus allowing them to craft Laravel session payloads when an application is using the "cookie" driver.
This fix prefixes cookie values with an HMAC hash of the cookie's name before encryption and then verifies a matching hash on decryption, making it impossible to craft a valid cookie payload even if an encryption oracle is exposed via the application.
Which versions are affected by GHSA-2ffv-r4r9-r8xr?
4 open source packages ship an affected version, including illuminate/cookie.
| Package | Affected | Fixed in |
|---|---|---|
illuminate/cookie Packagist | From 4.1.0 | 6.18.31 |
illuminate/cookie Packagist | From 4.1.0 | 6.18.31 |
illuminate/cookie Packagist | From 7.0.0 | 7.22.4 |
illuminate/cookie Packagist | From 7.0.0 | 7.22.4 |
How do I fix GHSA-2ffv-r4r9-r8xr?
Upgrade illuminate/cookie to a fixed version for your release line: 6.18.31 or 7.22.4.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is GHSA-2ffv-r4r9-r8xr being exploited?
There is no known exploitation of GHSA-2ffv-r4r9-r8xr in the wild and no public exploit code.