NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐘 Packagist
Not in CISA KEV

Laravel Guard bypass in Eloquent modelsGHSA-44pg-c29v-hp6r

GHSA-44pg-c29v-hp6r is a security vulnerability in laravel/framework. A fix is available for laravel/framework — see the affected versions and patch details below.

Published
Updated
Affected
3 pkgs
Patched
2 / 3
Exploits
None indexed
Exploitation data as of Nov 29, 2024 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

3 pkgs affected
🐘laravel/framework🐘laravel/framework🐘laravel/framework

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

Description

In laravel releases before 6.18.34 and 7.23.2. It was possible to mass assign Eloquent attributes that included the model's table name:

$model->fill(['users.name' => 'Taylor']);

When doing so, Eloquent would remove the table name from the attribute for you. This was a "convenience" feature of Eloquent and was not documented.

However, when paired with validation, this can lead to unexpected and unvalidated values being saved to the database. For this reason, we have removed the automatic stripping of table names from mass-asignment operations so that the attributes go through the typical "fillable" / "guarded" logic. Any attributes containing table names that are not explicitly declared as fillable will be discarded.

This security release will be a breaking change for applications that were relying on the undocumented table name stripping during mass assignment. Since this feature was relatively unknown and undocumented, we expect the vast majority of Laravel applications to be able to upgrade without issues.

Affected Packages

3 total 2 fixed
EcosystemPackageVulnerable rangeFix
🐘Packagistlaravel/framework≥ 5.5.0No fix
🐘Packagistlaravel/framework≥ 6.0.0&&< 6.18.346.18.34composer require laravel/framework:^6.18.34
🐘Packagistlaravel/framework≥ 7.0.0&&< 7.23.27.23.2composer require laravel/framework:^7.23.2

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for laravel/framework, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    A fix is available for GHSA-44pg-c29v-hp6r; check the affected-versions list above or the advisory for the patched release of laravel/framework, then make sure no transitive dependency still pins the vulnerable range.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

In laravel releases before 6.18.34 and 7.23.2. It was possible to mass assign Eloquent attributes that included the model's table name: ``` $model->fill(['users.name' => 'Taylor']); ``` When doing so, Eloquent would remove the table name from the attribute for you. This was a "convenience" feature of Eloquent and was not documented. However, when paired with validation, this can lead to unexpected and unvalidated values being saved to the database. For this reason, we have removed the automatic stripping of table names from mass-asignment operations so that the attributes go through the typic
O3 Security · Impact-Aware SCA

Is GHSA-44pg-c29v-hp6r in your dependencies?

Find it across Packagist, including transitive dependencies.

Scan my dependencies How O3 SCA works
Laravel Guard bypass in Eloquent models