GHSA-qm5c-m76r-2hfr Laravel RCE vulnerability in "cookie" session driver
Attackers can achieve remote code execution by exploiting an encryption oracle to craft malicious session payloads in applications using the cookie session driver.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-qm5c-m76r-2hfr?
GHSA-qm5c-m76r-2hfr is an unsafe deserialization vulnerability in laravel/framework, published on 15 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Which versions are affected by GHSA-qm5c-m76r-2hfr?
4 open source packages ship an affected version, including laravel/framework.
| Package | Affected | Fixed in |
|---|---|---|
laravel/framework Packagist | From 4.1.0 | 6.18.31 |
laravel/framework Packagist | From 4.1.0 | 6.18.31 |
laravel/framework Packagist | From 7.0.0 | 7.22.4 |
laravel/framework Packagist | From 7.0.0 | 7.22.4 |
How do I fix GHSA-qm5c-m76r-2hfr?
Upgrade laravel/framework to a fixed version for your release line: 6.18.31 or 7.22.4.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is GHSA-qm5c-m76r-2hfr being exploited?
There is no known exploitation of GHSA-qm5c-m76r-2hfr in the wild and no public exploit code.