Laravel: Task Output Injection - Concurrency Process
As published by the sources
Affected packages
- Affected
<12.71.0 || >=13.0.0,<13.40.0Fixed in12.71.013.40.0
Derived from the fixed versions above
What to do
Upgrade laravel/framework to the fixed version in your release line: 12.71.0, 13.40.0.
composer update laravel/framework --with-dependencies
To see which version you have installed, run composer show vendor/package. Running composer audit lists the known advisories that match your installed versions.
Quoted from the original advisory
Details
Summary
If a concurrency task prints user-controlled text, an attacker can forge the framework's internal result message and achieve remote code execution in certain conditions
Pre-reqs
Insecure code and insecure handling of user provided input (devs trust user-provided input) :
-
App has a route that reaches Concurrency::run() (Not by default, it requires app code)
-
The task writes user-controlled data to stdout (echo/print/
ddof input, hand-built JSON via string concat, passthrough of tool output), and the user-controlled bytes can be made to start the child's stdout and form a complete JSON document followed by \x1f\x8b (Not by default, requires the specific coding pattern in the app code)
Patches
- 13.40.0
- 12.71.0
References
- Advisoryhttps://github.com/advisories/GHSA-63hm-g96r-2m2q
- Webhttps://github.com/laravel/framework/security/advisories/GHSA-63hm-g96r-2m2q
- Webhttps://github.com/laravel/framework/pull/62297
- Webhttps://github.com/laravel/framework/commit/0f904940d176d51db1105cc925136f01bb69e92c
- Webhttps://github.com/laravel/framework/commit/c37133b89b30a86eb404537151edd8944e938f0a
- Webhttps://github.com/laravel/framework/releases/tag/v12.71.0
- Webhttps://github.com/laravel/framework/releases/tag/v13.40.0
- Packagehttps://github.com/laravel/framework