8.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-r33w-fg8j-9c94

GHSA-r33w-fg8j-9c94: MagicLink: Insecure Deserialization of MagicLink Actions Leads to Remote Code Execution

Description

MagicLink stores serialized action objects in the magic_links.action database column and deserializes them without integrity validation or class allowlisting in src/MagicLink.php and src/Actions/ResponseAction.php. An attacker with the ability to manipulate database records (e.g., via SQL injection or compromised admin access) could inject malicious serialized objects containing arbitrary closures, leading to Remote Code Execution (RCE) when the magic link is visited.

Resolution

The vulnerability has been mitigated through HMAC-signed serialization using the application key, class allowlisting restricted to ActionAbstract subclasses and framework classes, strict type validation preventing arbitrary object storage, and backward compatibility support for legacy data via allowed_classes in unserialize(). Implementation includes a new Serializable security class with signing/verification, refactored getter/setter methods in MagicLink.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-r33w-fg8j-9c94

GHSA-r33w-fg8j-9c94:

8.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
cesargb/laravel-magiclink	composer	>= 2.0.0, < 2.25.1	2.25.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the insecure deserialization of action objects stored in the database. The root cause is the use of PHP's unserialize() function on data retrieved from the magic_links.action column without proper integrity checks or a sufficiently strict class allowlist. An attacker with the ability to write to the database (e.g., via SQL injection) could insert a malicious serialized PHP object. When a user clicks the corresponding magic link, the MagicLinkController::access method is called, which triggers the deserialization of this malicious object through either MagicLink::getActionAttribute (calling the vulnerable legacyGetAction) or ResponseAction::run. This would lead to the execution of arbitrary code on the server.

The patch addresses this by completely removing the legacy deserialization logic that used unserialize() insecurely. It now exclusively relies on a new signed serialization mechanism (ActionSerializable), and any attempt to use the old, insecure format results in a LegacyActionFormatException, preventing the vulnerability from being triggered. The functions MagicLink::legacyGetAction and Security/Serializable/LegacyAllowClasses.php were removed entirely, as they were central to the insecure implementation.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.