State Guessing Vulnerability in laravel/socialite
laravel/socialite versions prior to 2.0.10 are susceptible to a security vulnerability related to state guessing during OAuth authentication. This vulnerability could potentially lead to session hijacking, allowing attackers to compromise user sessions. The issue has been addressed and fixed in version 2.0.10.
As published by the sources
Affected packages
- Affected
>=1.0.0,<2.0.10Fixed in2.0.10
Derived from the fixed versions above
What to do
Upgrade laravel/socialite to 2.0.10 or later.
composer update laravel/socialite --with-dependencies
To see which version you have installed, run composer show vendor/package. Running composer audit lists the known advisories that match your installed versions.
Quoted from the original advisory
Details
laravel/socialite versions prior to 2.0.10 are susceptible to a security vulnerability related to state guessing during OAuth authentication. This vulnerability could potentially lead to session hijacking, allowing attackers to compromise user sessions. The issue has been addressed and fixed in version 2.0.10.
References
- Advisoryhttps://github.com/laravel/socialite/pull/91
- Webhttps://github.com/laravel/socialite/pull/93
- Webhttps://github.com/laravel/socialite/commit/3d9ed9f4703de82a89541e2458f64de348a60a99
- Webhttps://github.com/FriendsOfPHP/security-advisories/blob/master/laravel/socialite/2015-08-03.yaml
- Packagehttps://github.com/laravel/socialite