PT-2024-8450 · Laravel+1 · Laravel+1

Taylorotwell · Published 2024-11-12 · Updated 2026-01-03 · CVE-2024-52301

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Laravel versions 6.20.45 through 11.31.0

Description The issue is related to the register argc argv php directive being set to on, allowing users to change the environment used by the framework when handling requests with a special crafted query string. This can lead to unauthorized access and data tampering. More than 830,000 instances are potentially affected.

Recommendations For versions 6.20.45 through 11.31.0, update to the latest version where the framework now ignores argv values for environment detection on non-cli SAPIs. As a temporary workaround, consider setting the register argc argv php directive to off until a patch is available. Restrict access to sensitive areas of the application to minimize the risk of exploitation.

Exploit

Fix

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

BDU:2024-10010

BIT-LARAVEL-2024-52301

CVE-2024-52301

DLA-3997-1

GHSA-GV7V-RGG6-548H

Affected Products

Debian

Laravel

References · 44

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52301.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/laravel/framework/CVE-2024-52301.yaml · Exploit
• 🔥 https://github.com/martinhaunschmid/CVE-2024-52301-Research · Exploit
• https://github.com/laravel/framework/security/advisories/GHSA-gv7v-rgg6-548h · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-52301 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-52301 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gv7v-rgg6-548h · Vendor Advisory
• https://osv.dev/vulnerability/BIT-laravel-2024-52301 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3997-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-52301 · Security Note
• https://bdu.fstec.ru/vul/2024-10010 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2024-52301 · Vendor Advisory
• https://github.com/laravel/framework · Note
• https://twitter.com/fletch_ai/status/1857680128899428628 · Twitter Post
• https://twitter.com/Clon3R17320/status/1859386347074748627 · Twitter Post