Security advisoryCVE-2024-52301

Laravel environment manipulation via query string

High0.0Published Nov 12, 2024Modified Dec 21, 2024Original advisory

As published by the sources

Affected packages

laravel/framework
Affected<6.20.45 || >=7.0.0,<7.30.7 || >=8.0.0,<8.83.28 || >=9.0.0,<9.52.17 || >=10.0.0,<10.48.23 || >=11.0.0,<11.31.0
Fixed in6.20.457.30.78.83.289.52.1710.48.2311.31.0

Derived from the fixed versions above

What to do

1
Upgrade laravel/framework to the fixed version in your release line: 6.20.45, 7.30.7, 8.83.28, 9.52.17, 10.48.23, 11.31.0.
```
composer update laravel/framework --with-dependencies
```

To see which version you have installed, run composer show vendor/package. Running composer audit lists the known advisories that match your installed versions.

Quoted from the original advisory

Details

Description

When the register_argc_argv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling the request.

Resolution

The framework now ignores argv values for environment detection on non-cli SAPIs.