GHSA-7852-w36x-6mf6
First published: Wed May 15 2024(Updated: )
The Laravel Encrypter component is susceptible to a vulnerability that may result in decryption failure, leading to an unexpected return of `false`. Exploiting this issue requires the attacker to manipulate the encrypted payload before decryption. When combined with weak type comparisons in the application's code, such as the example below: ``` <?php $decyptedValue = decrypt($secret); if ($decryptedValue == '') { // Code is run even though decrypted value is false... } ```
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/laravel/framework | >=5.6.0<5.6.15 | 5.6.15 |
| composer/laravel/framework | <5.5.40 | 5.5.40 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/laravel/framework/commit/28e53f23a76206fb130e9a54eb95aa3f010e79c9
- https://github.com/laravel/framework/commit/886d261df0854426b4662b7ed5db6a1c575a4279
- https://github.com/FriendsOfPHP/security-advisories/blob/master/laravel/framework/2018-03-30-1.yaml
- https://medium.com/@taylorotwell/laravel-security-release-5-6-15-and-5-5-40-56f1257933a0
- https://github.com/advisories/GHSA-7852-w36x-6mf6 (Advisory)
Frequently Asked Questions
What is the severity of GHSA-7852-w36x-6mf6?
The severity of GHSA-7852-w36x-6mf6 is considered moderate due to the potential for an attacker to exploit decryption failures.
How do I fix GHSA-7852-w36x-6mf6?
To fix GHSA-7852-w36x-6mf6, update the Laravel framework to version 5.6.15 or 5.5.40.
Who is affected by GHSA-7852-w36x-6mf6?
Developers using Laravel frameworks versions from 5.6.0 up to 5.6.14 or 5.5 up to 5.5.40 are affected by GHSA-7852-w36x-6mf6.
What happens if GHSA-7852-w36x-6mf6 is exploited?
If GHSA-7852-w36x-6mf6 is exploited, it may result in decryption failures and unexpected return of false values.
Is there a workaround for GHSA-7852-w36x-6mf6?
There is no known workaround for GHSA-7852-w36x-6mf6; patching to the recommended versions is advised.
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-7852-w36x-6mf6
- agent/software-canonical-lookup
- agent/weakness
- agent/references
- agent/severity
- agent/softwarecombine
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/type
- agent/description
- collector/github-advisory
- agent/tags
- agent/source
- package-manager/composer