N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-c42h-56wx-h85q

GHSA-c42h-56wx-h85q: laravel-auth0 SDK Deserialization of Untrusted Data vulnerability

Overview The laravel-auth0 SDK contains a critical vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data.

Am I Affected? You are affected by this vulnerability if you meet the following preconditions:

Applications using laravel-auth0 SDK, versions between 7.0.0-BETA1 to 7.2.1.
Laravel-auth0 SDK uses the Auth0-PHP SDK with version 8.0.0-BETA3 to 8.3.0.

Fix Upgrade Auth0/laravel-auth0 to the latest version (v7.17.0).

Acknowledgement Okta would like to thank Andreas Forsblom for discovering this vulnerability.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-c42h-56wx-h85q

GHSA-c42h-56wx-h85q:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
auth0/login	composer	>= 7.0.0-BETA1, <= 7.2.1	7.2.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the auth0/auth0-php SDK, specifically within the CookieStore class, which is a dependency of auth0/laravel-auth0. The advisory GHSA-c42h-56wx-h85q for laravel-auth0 points to GHSA-v9m8-9xxp-q492 for auth0-php as the root cause.

The patch for auth0-php (commit 04b1f5daa8bdfebc5e740ec5ca0fb2df1648a715 in auth0/auth0-php, corresponding to version 8.3.1) shows modifications in src/Store/CookieStore.php. The core of the vulnerability is the use of unserialize() on cookie data within the decrypt() method. An attacker could provide a specially crafted cookie containing a serialized PHP object, which, when processed by unserialize(), could lead to arbitrary code execution or other malicious outcomes.

The fix involves replacing the unserialize() call with json_decode(..., true) in the decrypt() method. Correspondingly, the encrypt() method was also updated to use json_encode() instead of serialize() to ensure data compatibility and security.

Therefore, the primary vulnerable function that would appear in a runtime profile during exploitation is Auth0\SDK\Store\CookieStore::decrypt from the auth0/auth0-php package, as it directly handles the deserialization of the potentially malicious cookie data. While laravel-auth0 is the affected package reported by the user, the actual vulnerable code resides in its dependency, auth0-php.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.