GHSA-jwvj-pwww-3mj5
laravel framework Unexpected database bindings via requests
- Severity
- High
- The publisher's own rating, not a CVSS score
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- —
- Not classified
- Fix
6.20.14- Upgrade laravel/framework to this version or later
Description
This is a follow-up to the security advisory https://github.com/laravel/framework/security/advisories/GHSA-3p32-j457-pg5x which addresses a few additional edge cases.
If a request is crafted where a field that is normally a non-array value is an array, and that input is not validated or cast to its expected type before being passed to the query builder, an unexpected number of query bindings can be added to the query. In some situations, this will simply lead to no results being returned by the query builder; however, it is possible certain queries could be affected in a way that causes the query to return unexpected results.
Affected versions
Packagist
| Package | Vulnerable | Fixed in |
|---|---|---|
| laravel/framework | >= 6.0.0, < 6.20.14 |
6.20.14 |
| laravel/framework | >= 7.0.0, < 7.30.4 |
7.30.4 |
| laravel/framework | >= 8.0.0, < 8.24.0 |
8.24.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
laravel/framework Packagist → 6.20.14
- composer
composer require laravel/framework:^6.20.14
References
Packages
Other links
Timeline
- Published
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| CVE-2018-15133 Laravel Framework RCE Vulnerability | High Known exploited | Also affects laravel/framework |
| GHSA-f9x3-7vq9-cph6 Laravel TokenGuard authentication bypass through non-string API credentials | Critical | Also affects laravel/framework |
| GHSA-5wcm-3v2w-8362 Laravel relationship inclusion can trigger unauthorized data destruction | Medium | Also affects laravel/framework |
| GHSA-jh5r-qr3c-85q8 Laravel: XSS in Debug Page Information | Low | Also affects laravel/framework |
| GHSA-crmm-hgp2-wgrp Laravel Framework: Temporary Signed URL Path Confusion | Medium | Also affects laravel/framework |
| GHSA-5vg9-5847-vvmq Laravel Framework: CRLF injection in default email rule | High | Also affects laravel/framework |
| GHSA-83wp-f5c3-hqqr Laravel framework susceptible to reflected cross-site scripting | Medium | Also affects laravel/framework |
| GHSA-546h-56qp-8jmw Laravel framework susceptible to reflected cross-site scripting | Medium | Also affects laravel/framework |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor