N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-69rh-hccr-cxrj

GHSA-69rh-hccr-cxrj: Laravel Rest Api has a Search Validation Bypass

A validation bypass vulnerability was discovered prior to version 2.13.0, where multiple validations defined for the same attribute could be silently overridden. Due to how the framework merged validation rules across multiple contexts (such as index, store, and update actions), malicious actors could exploit this behavior by crafting requests that bypass expected validation rules, potentially injecting unexpected or dangerous parameters into the application.

Impact:

This could lead to unauthorized data being accepted or processed by the API, depending on the context in which the validation was bypassed.

Patch:

The issue was fixed in PR #172 by ensuring that multiple rule definitions are merged correctly rather than overwritten.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-69rh-hccr-cxrj

GHSA-69rh-hccr-cxrj:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
lomkit/laravel-rest-api	composer	< 2.13.0	2.13.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, as described, is a validation bypass caused by the improper merging or overwriting of validation rules when multiple rules are defined for the same attribute across different contexts (e.g., base rules, action-specific rules, relation rules). The provided patch (commit 88b14587b4efd7e59d7379658c606d325bb513b4) completely refactors the validation rule system. It removes several rule classes, including MutateRules.php and SearchRules.php, which were central to the old validation logic.

The validate methods within these removed classes were responsible for orchestrating the application of various validation rules. For instance, MutateRules::validate made multiple calls to $this->validator->setRules(...). If Laravel's Validator::setRules() method overwrites previously set rules for the same attribute (which is typical unless rules are carefully merged into a single array passed to one setRules call), this sequential application could lead to rules from one stage (e.g., custom rules) overriding rules from another (e.g., base attribute rules), causing the bypass.

The new system introduces a RestRule base class whose validate method clones the validator before applying its specific rules and then merges any errors back. This approach isolates rule set applications and prevents direct overwriting on the main validator instance, which is a clear mitigation for the described vulnerability. The functions MutateRules::validate and SearchRules::validate are identified as vulnerable because they were the points where these potentially conflicting rule sets were applied in a way that could lead to overwriting, matching the vulnerability description. CustomRulable::validate is included with medium confidence as it was a component within this flawed system, contributing rules that could be part of the overwriting issue.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.