Blade `@parent` Exploitation Leading To Possible XSS in Laravel
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 8.75.0, 7.30.6, 6.20.42
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Laravel is a web application framework. Laravel prior to versions 8.75.0, 7.30.6, and 6.20.42 contain a possible cross-site scripting (XSS) vulnerability in the Blade templating engine. A broken HTML element may be clicked and the user taken to another location in their browser due to XSS. This is due to the user being able to guess the parent placeholder SHA-1 hash by trying common names of sections. If the parent template contains an exploitable HTML structure an XSS vulnerability can be exposed. This vulnerability has been patched in versions 8.75.0, 7.30.6, and 6.20.42 by determining the parent placeholder at runtime and using a random hash that is unique to each request.
Timeline
- CVE published
- Record last updated
Affected versions
- laravel framework
From 8.0.0 · fixed in 8.75.0; From 7.0.0 · fixed in 7.30.6; fixed in 6.20.42
- laravel/frameworkPackagist
fixed in 6.20.42
- laravel/frameworkPackagist
From 7.0.0 · fixed in 7.30.6
- laravel/frameworkPackagist
From 8.0.0 · fixed in 8.75.0
- illuminate/viewPackagist
fixed in 6.20.42
- illuminate/viewPackagist
From 7.0.0 · fixed in 7.30.6
- illuminate/viewPackagist
From 8.0.0 · fixed in 8.75.0