SBA Security Advisory – Laravel Reflected XSS via Route Parameter in Debug-Mode Error Page (CVE-2024-13919)
Vulnerability Overview
The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of route parameters in the debug-mode error page.
- Type of Vulnerability: Cross-Site Scripting
- Fixed in Version: 11.36.0
- CVE ID: CVE-2024-13919
- CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
- CVSS Base Score: 8.0 (High)
Recommended Countermeasure
If possible upgrade to the fixed version 11.36.0 or above. If you are unable to upgrade, ensure that the application does not run in debug-mode by setting `APP_DEBUG=false` in your configuration.
Links
Credits
Fabian Funder (SBA Research)
Philipp Adelsberger (SBA Research)