Critical Database Credential Leak in Laravel Framework
Date: April 16, 2024
CVE: CVE-2024-29291
Vulnerability Type: Improper Authentication
CWE: [[CWE-22]], [[CWE-427]]
Sources: Vulmon, GitHub
Issue Summary
A high-risk vulnerability identified in Laravel versions 8 through 11 allows remote attackers to access sensitive database credentials through the laravel.log component. This flaw exposes database usernames, passwords, and host details, posing significant security risks.
Technical Key findings
The vulnerability is exploited by accessing the laravel.log file on Laravel-based websites, which logs sensitive database connection details, including usernames and passwords, used by the PDO->__construct function.
Vulnerable products
- Laravel Framework versions 8.* to 11.*
Estimate usage:
Laravel is used by 44,323 companies worldwide and has a presence on 1,886,397 websites, both live and historically. It is particularly popular in the United States with 303,718 websites using the frameworkLaravel Usage Statistics.
Utilization Contexts:
Laravel is primarily used in web development, including building e-commerce platforms, educational websites, and high-traffic web applications.
Impact assessment
The exposure of database credentials can lead to unauthorized data access, data manipulation, and further system breaches, putting sensitive user and business data at risk.
Patches or workaround
Currently, no specific patches or official workarounds have been provided. It is advised to restrict access to the laravel.log file and monitor for patches.
Tags
#Laravel #DatabaseLeak #CVE-2024-29291 #RemoteAttack #SecurityVulnerability
