Critical Database Credential Leak in Laravel Framework

Date: April 16, 2024
CVE: CVE-2024-29291
Vulnerability Type: Improper Authentication
CWE: [[CWE-22]], [[CWE-427]]
Sources: Vulmon, GitHub

Issue Summary

A high-risk vulnerability identified in Laravel versions 8 through 11 allows remote attackers to access sensitive database credentials through the laravel.log component. This flaw exposes database usernames, passwords, and host details, posing significant security risks.

Technical Key findings

The vulnerability is exploited by accessing the laravel.log file on Laravel-based websites, which logs sensitive database connection details, including usernames and passwords, used by the PDO->__construct function.

Vulnerable products

• Laravel Framework versions 8.* to 11.*

Estimate usage:

Laravel is used by 44,323 companies worldwide and has a presence on 1,886,397 websites, both live and historically. It is particularly popular in the United States with 303,718 websites using the frameworkLaravel Usage Statistics.

Utilization Contexts:

Laravel is primarily used in web development, including building e-commerce platforms, educational websites, and high-traffic web applications.

Impact assessment

The exposure of database credentials can lead to unauthorized data access, data manipulation, and further system breaches, putting sensitive user and business data at risk.

Patches or workaround

Currently, no specific patches or official workarounds have been provided. It is advised to restrict access to the laravel.log file and monitor for patches.

Tags

#Laravel #DatabaseLeak #CVE-2024-29291 #RemoteAttack #SecurityVulnerability