GHSA-4mg9-vhxq-vm7j: Laravel/framework SQL Injection Vulnerability

HIGH
Share
CWE-89
Published
Advisory Summary

GHSA-4mg9-vhxq-vm7j is a HIGH sql injection vulnerability (CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')) affecting Laravel/framework libraries in the Packagist ecosystem. The issue involves sql server limit / offset sql injection in laravel/framework and illuminate/database. Remediation is available by upgrading affected packages to version 8.40.0, 6.20.26.

GHSA-4mg9-vhxq-vm7j at a Glance

CVE Identifier N/A
GHSA Identifier GHSA-4mg9-vhxq-vm7j
Severity HIGH
CVSS v3.1 Base Score N/A
CWE Classification CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected Product Laravel/framework
Package Ecosystem Packagist
Published Date
Last Updated

How to Fix GHSA-4mg9-vhxq-vm7j

To remediate this vulnerability, upgrade all affected Laravel/framework dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

laravel/framework fixed: 8.40.0 
Upgrade laravel/framework to 8.40.0
laravel/framework fixed: 6.20.26 
Upgrade laravel/framework to 6.20.26
illuminate/database fixed: 8.40.0 
Upgrade illuminate/database to 8.40.0
illuminate/database fixed: 6.20.26 
Upgrade illuminate/database to 6.20.26
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for laravel/framework

How to Check if You Are Affected

To determine whether your application is affected by GHSA-4mg9-vhxq-vm7j, inspect your project dependencies for Laravel/framework:

inspect dependencies for laravel/framework

Analyze the terminal output to locate any version of Laravel/framework in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 8.40.0), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), where the product constructs all or part of an sql command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended sql command when it is sent to a downstream component. without sufficient removal or quoting of sql syntax in user-controllable inputs, the generated sql query can cause those inputs to be interpreted as sql instead of ordinary user data. In Laravel/framework, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact Those using SQL Server with Laravel and allowing user input to be passed directly to the `limit` and `offset` functions are vulnerable to SQL injection. Other database drivers such as MySQL and Postgres are not affected by this vulnerability. ### Patches This problem has been patched on Laravel versions 6.20.26, 7.30.5, and 8.40.0. ### Workarounds You may workaround this vulnerability by ensuring that only integers are passed to the `limit` and `offset` functions, as well as the `skip` and `take` functions.

GHSA-4mg9-vhxq-vm7j Affected Laravel/framework Versions

4 component(s)
Fixed Versions:
8.40.06.20.26
Product / Package Ecosystem Affected Versions Fixed Version
laravel/framework
 Packagist
≥ 8.0.0
< 8.40.0
8.40.0
laravel/framework
 Packagist
< 6.20.26
6.20.26
illuminate/database
 Packagist
≥ 8.0.0
< 8.40.0
8.40.0
illuminate/database
 Packagist
< 6.20.26
6.20.26

References

GitHub Advisory / Wiki ADVISORY
https://github.com/laravel/framework/security/advisories/GHSA-4mg9-vhxq-vm7j
Laravel/framework Source Repository REPOSITORY
https://github.com/laravel/framework
packagist.org/packages/illuminate... WEB
https://packagist.org/packages/illuminate/database
packagist.org/packages/laravel/fr... WEB
https://packagist.org/packages/laravel/framework

Frequently Asked Questions

What is GHSA-4mg9-vhxq-vm7j?
GHSA-4mg9-vhxq-vm7j is a security vulnerability in Laravel/framework involving SQL Server LIMIT / OFFSET SQL Injection in laravel/framework and illuminate/database under CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection').
Which Laravel/framework versions are affected?
Affected versions include releases prior to 8.40.0, 6.20.26 across affected packages: laravel/framework, illuminate/database.
What version fixes GHSA-4mg9-vhxq-vm7j?
Upgrading to 8.40.0, 6.20.26 (or the latest patched release for your respective branch) resolves the vulnerability.
Is laravel/framework affected?
Yes, laravel/framework is affected in releases prior to 8.40.0, 6.20.26. Upgrade your dependency to 8.40.0, 6.20.26 or later.
Is illuminate/database affected?
Yes, illuminate/database is affected in releases prior to 8.40.0, 6.20.26. Upgrade your dependency to 8.40.0, 6.20.26 or later.
What CWE is associated with GHSA-4mg9-vhxq-vm7j?
GHSA-4mg9-vhxq-vm7j is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.).
How can I check Packagist dependencies for GHSA-4mg9-vhxq-vm7j?
Run the dependency tree command: 'inspect dependencies for laravel/framework'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-4mg9-vhxq-vm7j",
  "modified" : "2021-11-18T19:46:31Z",
  "published" : "2021-04-29T21:52:53Z",
  "aliases" : [ ],
  "summary" : "SQL Server LIMIT / OFFSET SQL Injection in laravel/framework and illuminate/database",
  "details" : "### Impact\n\nThose using SQL Server with Laravel and allowing user input to be passed directly to the `limit` and `offset` functions are vulnerable to SQL injection. Other database drivers such as MySQL and Postgres are not affected by this vulnerability.\n\n### Patches\n\nThis problem has been patched on Laravel versions 6.20.26, 7.30.5, and 8.40.0.\n\n### Workarounds\n\nYou may workaround this vulnerability by ensuring that only integers are passed to the `limit` and `offset` functions, as well as the `skip` and `take` functions.\n",
  "severity" : [ ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "laravel/framework"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "8.0.0"
      }, {
        "fixed" : "8.40.0"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "laravel/framework"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "6.20.26"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "illuminate/database"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "8.0.0"
      }, {
        "fixed" : "8.40.0"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "illuminate/database"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "6.20.26"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/laravel/framework/security/advisories/GHSA-4mg9-vhxq-vm7j"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/laravel/framework"
  }, {
    "type" : "WEB",
    "url" : "https://packagist.org/packages/illuminate/database"
  }, {
    "type" : "WEB",
    "url" : "https://packagist.org/packages/laravel/framework"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-89" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2021-04-28T20:17:07Z",
    "nvd_published_at" : null
  }
}