CVE-2024-52301: Laravel allows environment manipulation via query string
Description
When the registerargcargv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling the request.
Resolution
The framework now ignores argv values for environment detection on non-cli SAPIs.
Other sources
Laravel is a web application framework. When the registerargcargv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling the request. The vulnerability fixed in 6.20.45, 7.30.7, 8.83.28, 9.52.17, 10.48.23, and 11.31.0. The framework now ignores argv values for environment detection on non-cli SAPIs.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-52301?
CVE-2024-52301 is considered a moderate severity vulnerability due to its potential impact on the environment used by the framework.
How do I fix CVE-2024-52301?
To resolve CVE-2024-52301, update your Laravel framework to version 11.31.0, 10.48.23, 9.52.17, 8.83.28, 7.30.7, or 6.20.45 or later.
What types of systems are affected by CVE-2024-52301?
CVE-2024-52301 affects applications built on specific versions of the Laravel framework when the `register_argc_argv php` directive is set to `on`.
What does CVE-2024-52301 exploit?
CVE-2024-52301 exploits the ability to change the environment variables used by the Laravel framework through specially crafted query strings.
Is CVE-2024-52301 present in older versions of Laravel?
Yes, older versions of Laravel prior to the mentioned patches are vulnerable to CVE-2024-52301.