Laravel - Parameter Injection (CVE-2024-52301)
Description
Laravel is a web application framework. When the register_argc_argv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling the request. The vulnerability fixed in 6.20.45, 7.30.7, 8.83.28, 9.52.17, 10.48.23, and 11.31.0. The framework now ignores argv values for environment detection on non-cli SAPIs.
psychologyCrowdSec Analysis
CVE-2024-52301 is a vulnerability impacting the Laravel web application framework, where attackers can manipulate framework behavior by altering the execution environment through specially crafted query strings. This flaw can result in unauthorized privilege changes and potential compromise of application integrity.
CrowdSec has been tracking this vulnerability and its exploits since 20th of November 2024.
Data from the CrowdSec community indicates that exploitation of CVE-2024-52301 is highly selective and intelligence-driven. Threat actors use advanced reconnaissance and carefully choose their targets, often as part of sophisticated campaigns or advanced persistent threat operations. Telemetry from the CrowdSec network also shows that exploitation activity for CVE-2024-52301 remains steady week-over-week. Attack volumes are consistent with long-term trends, indicating sustained interest from threat actors. CVE-2024-52301 continues to be an active part of the threat landscape and will likely remain this way for the forseeable future.
Attack attempts often involve requests that use specially crafted query parameters ending with --env, aiming to control the application's environment settings during request handling.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2024-11-12 |
| Rule Released | 2024-11-20 |
| CrowdSec First Seen | 2024-11-25 |