Product - Laravel framework

Laravel framework

Description

Product names

laravel, framework

Related organization

Laravel

CVE-2021-21263 (GCVE-0-2021-21263)

Vulnerability from – Published: 2021-01-19 19:40 – Updated: 2024-08-03 18:09

Title

Query Binding Exploitation in Laravel

Summary

Laravel is a web application framework. Versions of Laravel before 6.20.11, 7.30.2 and 8.22.1 contain a query binding exploitation. This same exploit applies to the illuminate/database package which is used by Laravel. If a request is crafted where a field that is normally a non-array value is an array, and that input is not validated or cast to its expected type before being passed to the query builder, an unexpected number of query bindings can be added to the query. In some situations, this will simply lead to no results being returned by the query builder; however, it is possible certain queries could be affected in a way that causes the query to return unexpected results.

Severity ?

7.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

CWE

CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Assigner

GitHub_M

References

URL

Tags

	https://github.com/laravel/framework/security/adv…	x_refsource_CONFIRM
	https://github.com/laravel/framework/pull/35865	x_refsource_MISC
	https://blog.laravel.com/security-laravel-62011-7…	x_refsource_MISC
	https://packagist.org/packages/laravel/framework	x_refsource_MISC
	https://packagist.org/packages/illuminate/database	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	laravel	framework	Affected: >= 6.0.0, < 6.20.11 Affected: >= 7.0.0, < 7.30.2 Affected: >= 8.0.0, < 8.22.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T18:09:14.909Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/laravel/framework/security/advisories/GHSA-3p32-j457-pg5x"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/laravel/framework/pull/35865"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://blog.laravel.com/security-laravel-62011-7302-8221-released"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://packagist.org/packages/laravel/framework"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://packagist.org/packages/illuminate/database"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "framework",
          "vendor": "laravel",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 6.0.0, \u003c 6.20.11"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.0.0, \u003c 7.30.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.0, \u003c 8.22.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Laravel is a web application framework. Versions of Laravel before 6.20.11, 7.30.2 and 8.22.1 contain a query binding exploitation. This same exploit applies to the illuminate/database package which is used by Laravel. If a request is crafted where a field that is normally a non-array value is an array, and that input is not validated or cast to its expected type before being passed to the query builder, an unexpected number of query bindings can be added to the query. In some situations, this will simply lead to no results being returned by the query builder; however, it is possible certain queries could be affected in a way that causes the query to return unexpected results."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-01-19T19:40:18",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/laravel/framework/security/advisories/GHSA-3p32-j457-pg5x"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/laravel/framework/pull/35865"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://blog.laravel.com/security-laravel-62011-7302-8221-released"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://packagist.org/packages/laravel/framework"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://packagist.org/packages/illuminate/database"
        }
      ],
      "source": {
        "advisory": "GHSA-3p32-j457-pg5x",
        "discovery": "UNKNOWN"
      },
      "title": "Query Binding Exploitation in Laravel",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2021-21263",
          "STATE": "PUBLIC",
          "TITLE": "Query Binding Exploitation in Laravel"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "framework",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003e= 6.0.0, \u003c 6.20.11"
                          },
                          {
                            "version_value": "\u003e= 7.0.0, \u003c 7.30.2"
                          },
                          {
                            "version_value": "\u003e= 8.0.0, \u003c 8.22.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "laravel"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Laravel is a web application framework. Versions of Laravel before 6.20.11, 7.30.2 and 8.22.1 contain a query binding exploitation. This same exploit applies to the illuminate/database package which is used by Laravel. If a request is crafted where a field that is normally a non-array value is an array, and that input is not validated or cast to its expected type before being passed to the query builder, an unexpected number of query bindings can be added to the query. In some situations, this will simply lead to no results being returned by the query builder; however, it is possible certain queries could be affected in a way that causes the query to return unexpected results."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/laravel/framework/security/advisories/GHSA-3p32-j457-pg5x",
              "refsource": "CONFIRM",
              "url": "https://github.com/laravel/framework/security/advisories/GHSA-3p32-j457-pg5x"
            },
            {
              "name": "https://github.com/laravel/framework/pull/35865",
              "refsource": "MISC",
              "url": "https://github.com/laravel/framework/pull/35865"
            },
            {
              "name": "https://blog.laravel.com/security-laravel-62011-7302-8221-released",
              "refsource": "MISC",
              "url": "https://blog.laravel.com/security-laravel-62011-7302-8221-released"
            },
            {
              "name": "https://packagist.org/packages/laravel/framework",
              "refsource": "MISC",
              "url": "https://packagist.org/packages/laravel/framework"
            },
            {
              "name": "https://packagist.org/packages/illuminate/database",
              "refsource": "MISC",
              "url": "https://packagist.org/packages/illuminate/database"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-3p32-j457-pg5x",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2021-21263",
    "datePublished": "2021-01-19T19:40:18",
    "dateReserved": "2020-12-22T00:00:00",
    "dateUpdated": "2024-08-03T18:09:14.909Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}