3.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-hjfh-5jmm-xr24

GHSA-hjfh-5jmm-xr24: laravel-auth0 SDK Does Not Properly Handle File Types in Bulk User Import

Overview

In applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs.

Am I affected?

You are affected by this vulnerability if you meet the following preconditions:

Applications using the Auth0 laravel-auth0 SDK with version between 4.0.0 and 7.18.0,
Auth0 laravel-auth0 SDK uses the Auth0-PHP SDK with versions between 3.3.0 and 8.16.0.

Fix

Upgrade Auth0 laravel-auth0 SDK to version 7.19.0 or greater.

Acknowledgement

Okta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-hjfh-5jmm-xr24

GHSA-hjfh-5jmm-xr24:

3.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
auth0/login	composer	>= 4.0.0, <= 7.18.0	7.19.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability advisory points to an issue in the auth0/laravel-auth0 SDK related to improper file path validation during bulk user imports. The fixing commit for laravel-auth0 only updates the version of its dependency, auth0/auth0-php, indicating the actual vulnerability lies within the auth0/auth0-php package.

By comparing the git tags of auth0/auth0-php between the last vulnerable version (8.16.0) and the first patched version (8.17.0), I identified the security patch commit 9026da58f5c381cd4cb5932de829eff6eacbb65c. This commit reveals changes in two key files: src/Utility/HttpRequest.php and src/Utility/Assert.php.

The root cause of the vulnerability is in the Auth0\SDK\Utility\HttpRequest::addFile method. Before the patch, this method would accept any string as a file path without validation. This is dangerous because PHP's file functions can handle URLs and special stream wrappers, not just local file paths. An attacker could exploit this by providing a payload like php://filter/convert.base64-encode/resource=/etc/passwd to read sensitive files from the server.

The fix consists of two main changes:

The Auth0\SDK\Utility\HttpRequest::addFile method was updated to call Assert::fileExists() and Assert::readable() on the provided path before using it.
The Auth0\SDK\Utility\Assert::fileExists method was strengthened to reject any path that includes a protocol separator (://), effectively blocking the use of stream wrappers and remote URLs.

Both functions are included in the analysis. HttpRequest::addFile is the primary vulnerable function where the untrusted input is handled. Assert::fileExists represents the insufficient security control that was bypassed. A runtime profiler would show HttpRequest::addFile in the stack trace during exploitation.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.