Laravel cookie forgery, decryption, and RCE(labs.mwrinfosecurity.com)
labs.mwrinfosecurity.com
Laravel cookie forgery, decryption, and RCE
https://labs.mwrinfosecurity.com/blog/2014/04/11/laravel-cookie-forgery-decryption-and-rce/
4 comments
This is going to sound like empty language-war rhetoric, but: PHP might be the worst mainstream language in which to implement crypto. A crappy type system is one thing, but an unpredictable type system is much worse.
The enemy of any crypto is naïve assumption. That's not unique to PHP, but I agree, the type system can make it worse.
As usual, HN only cares about PHP when there's some FUD to spread.
This is an old bug that was made public and fixed over a year ago [0].
[0] http://www.reddit.com/r/PHP/comments/2332gq/laravel_cookie_f...
This is an old bug that was made public and fixed over a year ago [0].
[0] http://www.reddit.com/r/PHP/comments/2332gq/laravel_cookie_f...
I didn't intend to spread FUD when I posted this - I wasn't aware the equality check was also fixed. I use Laravel in a lot of projects and only saw it posted elsewhere today.
re the downvotes: fair enough I guess.
re the downvotes: fair enough I guess.
This bug was publicly disclosed and fixed over a year ago.
Was that disclosed by MWR? It might just be delayed publication on their blog.
Only sites which have error reporting enabled are vulnerable, so no need to panic unless you're displaying errors in production.
All sites were vulnerable to authenticating as other users or tampering with ciphertexts. Error reporting enables the RCE. However, I still hope that nobody is vulnerable or panicking since this was reported and fixed last year.