github - ghsa-3p32-j457-pg5x

ghsa-3p32-j457-pg5x

Vulnerability from github

Published

2021-01-19 19:36

Modified

2021-03-29 17:41

Severity ?

7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Summary

Query Binding Exploitation

Details

Description

Laravel versions <6.20.12, <7.30.3 & <8.22.1 contain a query binding exploitation.

If a request is crafted where a field that is normally a non-array value is an array, and that input is not validated or cast to its expected type before being passed to the query builder, an unexpected number of query bindings can be added to the query. In some situations, this will simply lead to no results being returned by the query builder; however, it is possible certain queries could be affected in a way that causes the query to return unexpected results.

This vulnerability was discovered by Tim Groenevelt (tim.g@foodbyus.com).

References

https://github.com/laravel/framework/pull/35865

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "laravel/framework"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.22.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "illuminate/database"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.0.0"
            },
            {
              "fixed": "7.30.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "illuminate/database"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.22.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "illuminate/database"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.0.0"
            },
            {
              "fixed": "6.20.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "laravel/framework"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.0.0"
            },
            {
              "fixed": "6.20.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "laravel/framework"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.0.0"
            },
            {
              "fixed": "7.30.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-21263"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-74",
      "CWE-89"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-01-19T19:36:31Z",
    "nvd_published_at": "2021-01-19T20:15:00Z",
    "severity": "HIGH"
  },
  "details": "### Description\n\nLaravel versions \u003c6.20.12, \u003c7.30.3 \u0026 \u003c8.22.1 contain a query binding exploitation.\n\nIf a request is crafted where a field that is normally a non-array value is an array, and that input is not validated or cast to its expected type before being passed to the query builder, an unexpected number of query bindings can be added to the query. In some situations, this will simply lead to no results being returned by the query builder; however, it is possible certain queries could be affected in a way that causes the query to return unexpected results.\n\nThis vulnerability was discovered by Tim Groenevelt (tim.g@foodbyus.com).\n\n### References\n\n- https://github.com/laravel/framework/pull/35865",
  "id": "GHSA-3p32-j457-pg5x",
  "modified": "2021-03-29T17:41:17Z",
  "published": "2021-01-19T19:36:51Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/laravel/framework/security/advisories/GHSA-3p32-j457-pg5x"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21263"
    },
    {
      "type": "WEB",
      "url": "https://github.com/laravel/framework/pull/35865"
    },
    {
      "type": "WEB",
      "url": "https://blog.laravel.com/security-laravel-62011-7302-8221-released"
    },
    {
      "type": "WEB",
      "url": "https://blog.laravel.com/security-laravel-62012-7303-released"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/illuminate/database/CVE-2021-21263.yaml"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/laravel/framework/CVE-2021-21263.yaml"
    },
    {
      "type": "WEB",
      "url": "https://packagist.org/packages/illuminate/database"
    },
    {
      "type": "WEB",
      "url": "https://packagist.org/packages/laravel/framework"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Query Binding Exploitation"
}

cve-2021-21263

Vulnerability from cvelistv5

Published

2021-01-19 19:40

Modified

2024-08-03 18:09

Severity ?

7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Summary

Laravel is a web application framework. Versions of Laravel before 6.20.11, 7.30.2 and 8.22.1 contain a query binding exploitation. This same exploit applies to the illuminate/database package which is used by Laravel. If a request is crafted where a field that is normally a non-array value is an array, and that input is not validated or cast to its expected type before being passed to the query builder, an unexpected number of query bindings can be added to the query. In some situations, this will simply lead to no results being returned by the query builder; however, it is possible certain queries could be affected in a way that causes the query to return unexpected results.

References

▼	URL	Tags
	https://github.com/laravel/framework/security/advisories/GHSA-3p32-j457-pg5x	x_refsource_CONFIRM
	https://github.com/laravel/framework/pull/35865	x_refsource_MISC
	https://blog.laravel.com/security-laravel-62011-7302-8221-released	x_refsource_MISC
	https://packagist.org/packages/laravel/framework	x_refsource_MISC
	https://packagist.org/packages/illuminate/database	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	laravel	framework	Version: >= 6.0.0, < 6.20.11 Version: >= 7.0.0, < 7.30.2 Version: >= 8.0.0, < 8.22.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T18:09:14.909Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/laravel/framework/security/advisories/GHSA-3p32-j457-pg5x"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/laravel/framework/pull/35865"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://blog.laravel.com/security-laravel-62011-7302-8221-released"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://packagist.org/packages/laravel/framework"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://packagist.org/packages/illuminate/database"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "framework",
          "vendor": "laravel",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 6.0.0, \u003c 6.20.11"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.0.0, \u003c 7.30.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.0, \u003c 8.22.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Laravel is a web application framework. Versions of Laravel before 6.20.11, 7.30.2 and 8.22.1 contain a query binding exploitation. This same exploit applies to the illuminate/database package which is used by Laravel. If a request is crafted where a field that is normally a non-array value is an array, and that input is not validated or cast to its expected type before being passed to the query builder, an unexpected number of query bindings can be added to the query. In some situations, this will simply lead to no results being returned by the query builder; however, it is possible certain queries could be affected in a way that causes the query to return unexpected results."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-01-19T19:40:18",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/laravel/framework/security/advisories/GHSA-3p32-j457-pg5x"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/laravel/framework/pull/35865"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://blog.laravel.com/security-laravel-62011-7302-8221-released"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://packagist.org/packages/laravel/framework"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://packagist.org/packages/illuminate/database"
        }
      ],
      "source": {
        "advisory": "GHSA-3p32-j457-pg5x",
        "discovery": "UNKNOWN"
      },
      "title": "Query Binding Exploitation in Laravel",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2021-21263",
          "STATE": "PUBLIC",
          "TITLE": "Query Binding Exploitation in Laravel"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "framework",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003e= 6.0.0, \u003c 6.20.11"
                          },
                          {
                            "version_value": "\u003e= 7.0.0, \u003c 7.30.2"
                          },
                          {
                            "version_value": "\u003e= 8.0.0, \u003c 8.22.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "laravel"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Laravel is a web application framework. Versions of Laravel before 6.20.11, 7.30.2 and 8.22.1 contain a query binding exploitation. This same exploit applies to the illuminate/database package which is used by Laravel. If a request is crafted where a field that is normally a non-array value is an array, and that input is not validated or cast to its expected type before being passed to the query builder, an unexpected number of query bindings can be added to the query. In some situations, this will simply lead to no results being returned by the query builder; however, it is possible certain queries could be affected in a way that causes the query to return unexpected results."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/laravel/framework/security/advisories/GHSA-3p32-j457-pg5x",
              "refsource": "CONFIRM",
              "url": "https://github.com/laravel/framework/security/advisories/GHSA-3p32-j457-pg5x"
            },
            {
              "name": "https://github.com/laravel/framework/pull/35865",
              "refsource": "MISC",
              "url": "https://github.com/laravel/framework/pull/35865"
            },
            {
              "name": "https://blog.laravel.com/security-laravel-62011-7302-8221-released",
              "refsource": "MISC",
              "url": "https://blog.laravel.com/security-laravel-62011-7302-8221-released"
            },
            {
              "name": "https://packagist.org/packages/laravel/framework",
              "refsource": "MISC",
              "url": "https://packagist.org/packages/laravel/framework"
            },
            {
              "name": "https://packagist.org/packages/illuminate/database",
              "refsource": "MISC",
              "url": "https://packagist.org/packages/illuminate/database"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-3p32-j457-pg5x",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2021-21263",
    "datePublished": "2021-01-19T19:40:18",
    "dateReserved": "2020-12-22T00:00:00",
    "dateUpdated": "2024-08-03T18:09:14.909Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

ghsa-3p32-j457-pg5x

Vulnerability from github

Description

References

cve-2021-21263

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature