GHSA-7852-w36x-6mf6

Laravel Encrypter Component Potential Decryption Failure Leading to Unintended Behavior

Medium Packagist

Severity: Medium; The publisher's own rating, not a CVSS score
Exploit chance (EPSS): —; No score published
Known exploited: No; Not in CISA's catalog
Weakness: CWE-1240 Use of a Cryptographic Primitive with a Risky Implementation
Fix: 5.5.40; Upgrade laravel/framework to this version or later

Description

The Laravel Encrypter component is susceptible to a vulnerability that may result in decryption failure, leading to an unexpected return of false. Exploiting this issue requires the attacker to manipulate the encrypted payload before decryption. When combined with weak type comparisons in the application's code, such as the example below:

<?php

$decyptedValue = decrypt($secret);

if ($decryptedValue == '') {
    // Code is run even though decrypted value is false...
}

Affected versions

Packagist

Package	Vulnerable	Fixed in
laravel/framework	`< 5.5.40`	`5.5.40`
laravel/framework	`>= 5.6.0, < 5.6.15`	`5.6.15`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

laravel/framework Packagist → `5.5.40`

composer

composer require laravel/framework:^5.5.40

Weakness

CWE-1240: Use of a Cryptographic Primitive with a Risky Implementation

To fulfill the need for a cryptographic primitive, the product implements a cryptographic algorithm using a non-standard, unproven, or disallowed/non-compliant cryptographic implementation.

How to prevent it

Requirements: Require compliance with the strongest-available recommendations from trusted parties, and require that compliance must be kept up-to-date, since recommendations evolve over time. For example, US government systems require FIPS 140-3 certification, which supersedes FIPS 140-2 [REF-1192] [REF-267].
Architecture and Design: Ensure that the architecture/design uses the strongest-available primitives and algorithms from trusted parties. For example, US government systems require FIPS 140-3 certification, which supersedes FIPS 140-2 [REF-1192] [REF-267].
Architecture and Design: Do not develop custom or private cryptographic algorithms. They will likely be exposed to attacks that are well-understood by cryptographers. As with all cryptographic mechanisms, the source code should be available for analysis. If the algorithm may be compromised when attackers find out how it works, then it is especially weak.
Architecture and Design: Try not to use cryptographic algorithms in novel ways or with new modes of operation even when you "know" it is secure. For example, using SHA-2 chaining to create a 1-time pad for encryption might sound like a good idea, but one should not do this.
Architecture and Design: Ensure that the design can replace one cryptographic primitive or algorithm with another in the next generation ("cryptographic agility"). Where possible, use wrappers to make the interfaces uniform. This will make it easier to upgrade to stronger algorithms. This is especially important for hardware, which can be more difficult to upgrade quickly than software; design the hardware at a replaceable block level.
Architecture and Design: Do not use outdated or non-compliant cryptography algorithms. Some older algorithms, once thought to require a billion years of computing time, can now be broken in days or hours. This includes MD4, MD5, SHA1, DES, and other algorithms that were once regarded as strong [REF-267].
Architecture and Design, Implementation: Do not use a linear-feedback shift register (LFSR) or other legacy methods as a substitute for an accepted and standard Random Number Generator.
Architecture and Design, Implementation: Do not use a checksum as a substitute for a cryptographically generated hash.
Architecture and Design: Use a vetted cryptographic library or framework. Industry-standard implementations will save development time and are more likely to avoid errors that can occur during implementation of cryptographic algorithms. However, the library/framework could be used incorrectly during implementation.
Architecture and Design, Implementation: When using industry-approved techniques, use them correctly. Don't cut corners by skipping resource-intensive steps (CWE-325). These steps are often essential for the prevention of common attacks.
Architecture and Design, Implementation: Do not store keys in areas accessible to untrusted agents. Carefully manage and protect the cryptographic keys (see CWE-320). If the keys can be guessed or stolen, then the strength of the cryptography algorithm is irrelevant.

References

Packages

github.com/laravel/framework

Timeline

May 15, 2024 Published
Nov 29, 2024 Last updated by the source

Advisory	Severity	Why it's related
CVE-2018-15133 Laravel Framework RCE Vulnerability	High Known exploited	Also affects laravel/framework
GHSA-f9x3-7vq9-cph6 Laravel TokenGuard authentication bypass through non-string API credentials	Critical	Also affects laravel/framework
GHSA-5wcm-3v2w-8362 Laravel relationship inclusion can trigger unauthorized data destruction	Medium	Also affects laravel/framework
GHSA-jh5r-qr3c-85q8 Laravel: XSS in Debug Page Information	Low	Also affects laravel/framework
GHSA-crmm-hgp2-wgrp Laravel Framework: Temporary Signed URL Path Confusion	Medium	Also affects laravel/framework
GHSA-5vg9-5847-vvmq Laravel Framework: CRLF injection in default email rule	High	Also affects laravel/framework
GHSA-83wp-f5c3-hqqr Laravel framework susceptible to reflected cross-site scripting	Medium	Also affects laravel/framework
GHSA-546h-56qp-8jmw Laravel framework susceptible to reflected cross-site scripting	Medium	Also affects laravel/framework

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor