Laravel allows environment manipulation via query string
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.20.45, 7.30.7, 8.83.28, 9.52.17, 10.48.23, and 1 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 3 proofs of concept on GitHub
- Exploitation: none
- Automatable: yes
- Technical impact: partial
Summary
Laravel is a web application framework. When the register_argc_argv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling the request. The vulnerability fixed in 6.20.45, 7.30.7, 8.83.28, 9.52.17, 10.48.23, and 11.31.0. The framework now ignores argv values for environment detection on non-cli SAPIs.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: partial
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- laravel framework
fixed in 6.20.45; From 7.0.0 · fixed in 7.30.7; From 8.0.0 · fixed in 8.83.28; From 9.0.0 · fixed in 9.52.17; From 10.0.0 · fixed in 10.48.23; From 11.0.0 · fixed in 11.31.0
- laravel/frameworkPackagist
fixed in 6.20.45
- laravel/frameworkPackagist
From 7.0.0 · fixed in 7.30.7
- laravel/frameworkPackagist
From 8.0.0 · fixed in 8.83.28
- laravel/frameworkPackagist
From 9.0.0 · fixed in 9.52.17
- laravel/frameworkPackagist
From 10.0.0 · fixed in 10.48.23
- laravel/frameworkPackagist
From 11.0.0 · fixed in 11.31.0