CVE-2020-24941

An issue was discovered in Laravel before 6.18.35 and 7.x before 7.24.0. The $guarded property is mishandled in some situations involving requests with JSON column nesting expressions.

An issue was discovered in Laravel before 6.18.35 and 7.x before 7.24.0. The $guarded property is mishandled in some situations involving requests with JSON column nesting expressions.

An issue was discovered in Laravel before 6.18.35 and 7.x before 7.24.0. The $guarded property is mishandled in some situations involving requests with JSON column nesting expressions.

TuxCare rebuilt laravel/framework to address 5 CVEs. Fixed in 5.8.38-p1+tuxcare.

TuxCare rebuilt illuminate/database to address 1 CVE. Fixed in 5.4.36-p1+tuxcare.

TuxCare rebuilt laravel/framework to address 10 CVEs. Fixed in 5.4.36-p2+tuxcare.

TuxCare rebuilt laravel/framework to address 8 CVEs. Fixed in 5.5.50-p1+tuxcare.

TuxCare rebuilt laravel/framework to address 9 CVEs. Fixed in 5.6.40-p1+tuxcare.

TuxCare rebuilt laravel/framework to address 9 CVEs. Fixed in 5.7.29-p1+tuxcare.

TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 5.4.36-p3+tuxcare.

Impact

Those using SQL Server with Laravel and allowing user input to be passed directly to the limit and offset functions are vulnerable to SQL injection. Other database drivers such as MySQL and Postgres are not affected by this vulnerability.

Patches

This problem has been patched on Laravel versions 6.20.26, 7.30.5, and 8.40.0.

Workarounds

You may workaround this vulnerability by ensuring that only integers are passed to the limit and offset functions, as well as the skip and take functions.

The Laravel Encrypter component is susceptible to a vulnerability that may result in decryption failure, leading to an unexpected return of false. Exploiting this issue requires the attacker to manipulate the encrypted payload before decryption. When combined with weak type comparisons in the application's code, such as the example below:

<?php

$decyptedValue = decrypt($secret);

if ($decryptedValue == '') {
    // Code is run even though decrypted value is false...
}