The Laravel framework versions 11.9.0 to 11.35.1 are vulnerable to reflected cross-site scripting (XSS) due to improper encoding of route parameters in the debug-mode error page. When debug mode is enabled, user-supplied input in route parameters is not properly sanitized before being rendered in the error page. This allows an attacker to inject malicious JavaScript code into the page, which is then executed in the context of the victim’s browser. The vulnerability is triggered when a user visits a specially crafted URL containing the malicious payload. This can lead to session hijacking, defacement, or other client-side attacks.
DailyCVE Form:
Platform: Laravel Framework
Version: 11.9.0 to 11.35.1
Vulnerability: Reflected XSS
Severity: Moderate
Date: Mar 10, 2025
What Undercode Say:
Exploitation:
- Craft a malicious URL with a JavaScript payload in the route parameter.
Example: `http://example.com/route/`
2. Send the URL to a victim or trick them into clicking it. - When the victim accesses the URL, the payload executes in their browser.
Protection:
- Update Laravel to the patched version 11.36.0 or later.
- Disable debug mode in production environments by setting `APP_DEBUG=false` in the `.env` file.
- Implement Content Security Policy (CSP) headers to mitigate XSS risks.
Example CSP header: `Content-Security-Policy: default-src ‘self’; script-src ‘self’;`
- Sanitize user input using Laravel’s built-in validation and escaping functions.
Commands:
1. Update Laravel:
composer update laravel/framework --with-all-dependencies
2. Disable debug mode:
echo 'APP_DEBUG=false' >> .env
3. Verify Laravel version:
php artisan --version
Code Examples:
1. Sanitize user input in controllers:
$input = request()->input('param');
$sanitizedInput = e($input); // Escapes HTML entities
2. Add CSP headers in middleware:
public function handle($request, Closure $next)
{
$response = $next($request);
$response->header('Content-Security-Policy', "default-src 'self'; script-src 'self'");
return $response;
}
Analytics:
- Affected versions: 11.9.0 to 11.35.1
- Patched version: 11.36.0
- Severity score: CVSS 6.5 (Moderate)
- Exploitability: Low complexity, requires user interaction
- Impact: Confidentiality and integrity compromise
By following these steps, developers can mitigate the risk of this vulnerability and ensure their Laravel applications remain secure.
References:
Reported By: https://github.com/advisories/GHSA-83wp-f5c3-hqqr
Extra Source Hub:
Undercode
