CVE-2024-13918
📋 TL;DR
Laravel framework versions 11.9.0 through 11.35.1 contain a reflected cross-site scripting vulnerability in debug-mode error pages. Attackers can inject malicious scripts via request parameters that are improperly encoded, potentially compromising user sessions. This affects any Laravel application running debug mode with these vulnerable versions.
💻 Affected Systems
- Laravel PHP Framework
📦 What is this software?
Framework by Laravel
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal session cookies, perform actions as authenticated users, redirect to malicious sites, or install malware on user systems.
Likely Case
Session hijacking leading to unauthorized access, data theft, or account takeover for users who visit malicious links.
If Mitigated
Limited impact if debug mode is disabled in production, but development/staging environments remain vulnerable.
🎯 Exploit Status
Exploitation requires user interaction (clicking malicious link) and debug mode enabled. No authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v11.36.0
Vendor Advisory: https://github.com/laravel/framework/releases/tag/v11.36.0
Restart Required: No
Instructions:
1. Update Laravel to version 11.36.0 or later via composer: 'composer require laravel/framework:^11.36.0'. 2. Run 'composer update'. 3. Clear application cache: 'php artisan config:clear' and 'php artisan cache:clear'.
🔧 Temporary Workarounds
Disable Debug Mode
allSet APP_DEBUG=false in .env file to prevent debug error pages from being served.
echo 'APP_DEBUG=false' >> .env
php artisan config:clear
🧯 If You Can't Patch
- Disable debug mode immediately in all environments.
- Implement web application firewall (WAF) rules to block XSS payloads in request parameters.
🔍 How to Verify
Check if Vulnerable:
Check Laravel version via 'composer show laravel/framework' and verify if between 11.9.0-11.35.1. Also check .env for APP_DEBUG=true.Check Version:
composer show laravel/framework | grep versionsVerify Fix Applied:
Confirm Laravel version is 11.36.0 or higher with 'composer show laravel/framework'.📡 Detection & Monitoring
Log Indicators:
- Unusual error page requests with long parameter values
- Requests containing script tags or JavaScript in URL parameters
Network Indicators:
- HTTP requests with suspicious parameters like <script> tags to error pages
SIEM Query:
web_logs WHERE url CONTAINS '/_ignition/execute-solution' AND (url CONTAINS '<script' OR url CONTAINS 'javascript:')🔗 References
- https://github.com/laravel/framework/pull/53869
- https://github.com/laravel/framework/releases/tag/v11.36.0
- https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20241209-01_Laravel_Reflected_XSS_via_Request_Parameter_in_Debug-Mode_Error_Page
- http://www.openwall.com/lists/oss-security/2025/03/10/3
