GHSA-7fjp-g4m7-fx23 User (Encrypted) Password Field Being Serialised
Attackers can retrieve encrypted user passwords by requesting the User model in JSON or array format due to missing serialization exclusions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-7fjp-g4m7-fx23?
GHSA-7fjp-g4m7-fx23 is a vulnerability in pwweb/laravel-core, published on 13 Apr 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
Leaking Password field during serialisation of the User model. Password is in the encrypted form but if User model is requested in json or array form the value is printed.
Patches
Issue has been patched in version 0.3.7-beta and onwards.
Workarounds
Add the 'password' field to the Users model file in the hidden array:
/**
* The attributes that should be hidden for arrays.
*
* @var array
*/
protected $hidden = [
'remember_token',
'password',
];
For more information
If you have any questions or comments about this advisory:
- Open an issue in pwweb/laravel-core
- Email us at [email protected]
Which versions are affected by GHSA-7fjp-g4m7-fx23?
2 open source packages ship an affected version, including pwweb/laravel-core.
| Package | Affected | Fixed in |
|---|---|---|
pwweb/laravel-core Packagist | All versions | 0.3.7-beta |
pwweb/laravel-core Packagist | All versions | 0.3.7-beta |
How do I fix GHSA-7fjp-g4m7-fx23?
Upgrade pwweb/laravel-core to 0.3.7-beta or later.
Is GHSA-7fjp-g4m7-fx23 being exploited?
There is no known exploitation of GHSA-7fjp-g4m7-fx23 in the wild and no public exploit code.