Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS02d2p3LXFmODctZnY1ds4AA8Ii

Laravel Encrypter Failure to decryption vulnerability

A potential exploit of the Laravel Encrypter component that may cause the Encrypter to fail on decryption and unexpectedly return false.

To exploit this, the attacker must be able to modify the encrypted payload before it is decrypted. Depending on the code within your application, this could lead to unexpected behavior when combined with weak type comparisons, for example:

<?php

$decyptedValue = decrypt($secret);

if ($decryptedValue == '') {
    // Code is run even though decrypted value is false...
}

Permalink: https://github.com/advisories/GHSA-6wjw-qf87-fv5v
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02d2p3LXFmODctZnY1ds4AA8Ii
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Low
Classification: General
Published: 6 months ago
Updated: 6 months ago

Identifiers: GHSA-6wjw-qf87-fv5v
References:

• https://github.com/illuminate/encryption/commit/51667a52bd7d135c6aa40a897656ffe9d3cd072d
• https://github.com/illuminate/encryption/commit/c80b1da6a0412bd74bd56dc80f6126f561631b05
• https://github.com/FriendsOfPHP/security-advisories/blob/master/illuminate/encryption/2018-03-30-1.yaml
• https://medium.com/@taylorotwell/laravel-security-release-5-6-15-and-5-5-40-56f1257933a0
• https://github.com/advisories/GHSA-6wjw-qf87-fv5v

Repository: https://github.com/illuminate/encryption
Blast Radius: 0.0

Affected Packages