{"answers":{"affected":"4 open source packages ship an affected version, including illuminate/cookie.","exploited":"There is no known exploitation of GHSA-2ffv-r4r9-r8xr in the wild and no public exploit code.","fix":"Upgrade illuminate/cookie to a fixed version for your release line: 6.18.31 or 7.22.4.","what":"GHSA-2ffv-r4r9-r8xr is a code injection vulnerability in illuminate/cookie, published on 15 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-2ffv-r4r9-r8xr and fix it if it is affected.\n\nWhat it is: GHSA-2ffv-r4r9-r8xr is a code injection vulnerability in illuminate/cookie, published on 15 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-2ffv-r4r9-r8xr in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- illuminate/cookie (Packagist): affected from 4.1.0; fixed in 6.18.31\n- illuminate/cookie (Packagist): affected from 4.1.0; fixed in 6.18.31\n- illuminate/cookie (Packagist): affected from 7.0.0; fixed in 7.22.4\n- illuminate/cookie (Packagist): affected from 7.0.0; fixed in 7.22.4\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-2ffv-r4r9-r8xr/ (Markdown: https://insights.sbomify.com/GHSA-2ffv-r4r9-r8xr/index.md)","id":"GHSA-2ffv-r4r9-r8xr","markdown":"https://insights.sbomify.com/GHSA-2ffv-r4r9-r8xr/index.md","name":"GHSA-2ffv-r4r9-r8xr","record":{"aliases":[],"analysis":{"component_type":"web_application","fix_type":"patch","impacts":["code_execution"],"network_reachable":"yes","non_default_config":true,"product_category":"Laravel framework","requires_auth":"none","summary":"Attackers can achieve remote code execution in Laravel apps using the cookie session driver if an encryption oracle is exposed.","user_interaction":"not_required","vuln_class":"code_injection"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"Application's using the \"cookie\" session driver were the primary applications affected by this vulnerability. Since we have not yet released a security release for the Laravel 5.5 version of the framework, we recommend that all applications running Laravel 5.5 and earlier do not use the \"cookie\" session driver in their production deployments.\n\nRegarding the vulnerability, applications using the \"cookie\" session driver that were also exposing an encryption oracle via their application were vulnerable to remote code execution. An encryption oracle is a mechanism where arbitrary user input is encrypted and the encrypted string is later displayed or exposed to the user. This combination of scenarios lets the user generate valid Laravel signed encryption strings for any plain-text string, thus allowing them to craft Laravel session payloads when an application is using the \"cookie\" driver.\n\nThis fix prefixes cookie values with an HMAC hash of the cookie's name before encryption and then verifies a matching hash on decryption, making it impossible to craft a valid cookie payload even if an encryption oracle is exposed via the application.","ecosystems":["Packagist"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Laravel RCE vulnerability in \"cookie\" session driver","id":"GHSA-2ffv-r4r9-r8xr","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"Packagist","product":null,"products":[],"type":"code_injection","year":"2024"},"n_packages":4,"n_references":null,"packages":[{"ecosystem":"Packagist","fixed":["6.18.31"],"introduced":["4.1.0"],"last_affected":[],"package":"illuminate/cookie","purl":null,"source":"GHSA-2ffv-r4r9-r8xr"},{"ecosystem":"Packagist","fixed":["6.18.31"],"introduced":["4.1.0"],"last_affected":[],"package":"illuminate/cookie","purl":"pkg:composer/illuminate/cookie","source":"GHSA-2ffv-r4r9-r8xr"},{"ecosystem":"Packagist","fixed":["7.22.4"],"introduced":["7.0.0"],"last_affected":[],"package":"illuminate/cookie","purl":null,"source":"GHSA-2ffv-r4r9-r8xr"},{"ecosystem":"Packagist","fixed":["7.22.4"],"introduced":["7.0.0"],"last_affected":[],"package":"illuminate/cookie","purl":"pkg:composer/illuminate/cookie","source":"GHSA-2ffv-r4r9-r8xr"}],"products":null,"published":"2024-05-15","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Attackers can achieve remote code execution in Laravel apps using the cookie session driver if an encryption oracle is exposed.","url":"https://insights.sbomify.com/GHSA-2ffv-r4r9-r8xr/"}