InfoSecBulletin Cybersecurity for mankind
A significant security flaw, CVE-2024-52301, has been found in the Laravel framework, which is widely used for web applications. With a CVSS rating of 8.7, this vulnerability could allow unauthorized access, data tampering, and privilege escalation in many Laravel applications.
CVE-2024-52301 pertains to inadequate input validation in Laravel’s environment configuration. The problem arises from how Laravel manages PHP’s register_argc_argv directive, which allows command-line arguments in scripts. If this directive is enabled, attackers could exploit it with malicious URLs to modify environment variables used by Laravel during request processing.
WhatsApp banned on all US House of Representatives devices
Kaspersky found “SparkKitty” Malware on Google Play, Apple App Store
OWASP AI Testing Guide Launched to Uncover Vulns in AI Systems
Axentec Launches Bangladesh’s First Locally Hosted Tier-4 Cloud Platform
Hackers Bypass Gmail MFA With App-Specific Password Reuse
Russia detects first SuperCard malware attacks via NFC
Income Property Investments exposes 170,000+ Individuals record
ALERT (CVE: 2023-28771)
Zyxel Firewalls Under Attack via CVE-2023-28771 by 244 IPs
CISA Flags Active Exploits in Apple iOS and TP-Link Routers
10K Records Allegedly from Mac Cloud Provider’s Customers Leaked Online
Improper validation allows attackers to bypass input checks or inject harmful data. With register_argc_argv enabled, Laravel applications are at higher risk, as attackers can exploit PHP’s default behavior to gain unauthorized control over the application.
Laravel is popular for web applications and APIs, making its vulnerability a significant concern due to its widespread use. This flaw impacts several versions of Laravel, including:
Versions < 6.20.45
Versions >= 7.0.0 and < 7.30.7
Versions >= 8.0.0 and < 8.83.28
Versions >= 9.0.0 and < 9.52.17
Versions >= 10.0.0 and < 10.48.23
Versions >= 11.0.0 and < 11.31.0
Organizations using these Laravel versions for public applications may be vulnerable to attacks that could lead to unauthorized access and data breaches.
In response to CVE-2024-52301, Laravel has issued patches across affected versions, with the updated versions being:
6.20.45
7.30.7
8.83.28
9.52.17
10.48.23
11.31.0
The latest Laravel patch prevents environment detection using argv values on non-CLI interfaces, closing a security vulnerability. Developers should upgrade to the updated versions immediately.
