Improper Encoding or Escaping of Output in Laravel Framework - #VU166051

Vulnerability details

The vulnerability allows a remote attacker to bypass expiration restrictions on temporary signed URLs.

The vulnerability exists due to missing URL encoding in Laravel's temporarySignedRoute() and signedRoute() methods when applications forward attacker-influenced, numeric-keyed parameters that do not fill route placeholders into signed URL generation. A remote attacker can inject a second expires query parameter, covered by the signature but treated as authoritative during request parsing, to make the signed URL never expire.

Affected software

Remediation

External References

• https://github.com/laravel/framework/security/advisories/GHSA-6rv8-qj5v-p8ch

Related Security Bulletins

• Multiple vulnerabilities in Laravel Framework