GHSA-7852-w36x-6mf6 Laravel Encrypter Component Potential Decryption Failure Leading to Unintended Behavior
Attackers can manipulate encrypted payloads to cause decryption failures, potentially bypassing security checks in applications using weak type comparisons.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-7852-w36x-6mf6?
GHSA-7852-w36x-6mf6 is a vulnerability in laravel/framework, published on 15 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Laravel Encrypter component is susceptible to a vulnerability that may result in decryption failure, leading to an unexpected return of false. Exploiting this issue requires the attacker to manipulate the encrypted payload before decryption. When combined with weak type comparisons in the application's code, such as the example below:
<?php
$decyptedValue = decrypt($secret);
if ($decryptedValue == '') {
// Code is run even though decrypted value is false...
}
Which versions are affected by GHSA-7852-w36x-6mf6?
4 open source packages ship an affected version, including laravel/framework.
| Package | Affected | Fixed in |
|---|---|---|
laravel/framework Packagist | All versions | 5.5.40 |
laravel/framework Packagist | All versions | 5.5.40 |
laravel/framework Packagist | From 5.6.0 | 5.6.15 |
laravel/framework Packagist | From 5.6.0 | 5.6.15 |
How do I fix GHSA-7852-w36x-6mf6?
Upgrade laravel/framework to a fixed version for your release line: 5.5.40 or 5.6.15.
Is GHSA-7852-w36x-6mf6 being exploited?
There is no known exploitation of GHSA-7852-w36x-6mf6 in the wild and no public exploit code.