Skip to content

Laravel Encrypter Failure to decryption vulnerability

Low severity GitHub Reviewed Published May 15, 2024 to the GitHub Advisory Database • Updated May 15, 2024

Package

composer illuminate/encryption (Composer)

Affected versions

>= 5.5.0, < 5.5.40
>= 5.6.0, < 5.6.15

Patched versions

5.5.40
5.6.15

Description

A potential exploit of the Laravel Encrypter component that may cause the Encrypter to fail on decryption and unexpectedly return false.

To exploit this, the attacker must be able to modify the encrypted payload before it is decrypted. Depending on the code within your application, this could lead to unexpected behavior when combined with weak type comparisons, for example:

<?php

$decyptedValue = decrypt($secret);

if ($decryptedValue == '') {
    // Code is run even though decrypted value is false...
}

References

Published to the GitHub Advisory Database May 15, 2024
Reviewed May 15, 2024
Last updated May 15, 2024

Severity

Low

Weaknesses

CVE ID

No known CVE

GHSA ID

GHSA-6wjw-qf87-fv5v

Source code

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.