HuntersHunters
Sign inStart free
Security context
Medium· 6.1GHSA-rc8x-jrrc-frfv CVE-2017-9303CWE-20Published May 17, 2022

Laravel does not properly constrain the host portion of a password-reset URL

Research this vulnerability

Research is free — Hunters explains how the bug works, the root-cause code pattern, how the fix addresses it, and how to test whether a target is affected, in chat. Investigate & write exploit is a paid run — the engine reads the advisory and fix commits, then builds and validates a working proof-of-concept exploit with reproduction steps.

Affected versions

5.4.0 → fixed in 5.4.225.3.0 and later (no fix listed)

Details

Laravel 5.4.x before 5.4.22 does not properly constrain the host portion of a password-reset URL, which makes it easier for remote attackers to conduct phishing attacks by specifying an attacker-controlled host.

The fix

force host on password reset notification

Taylor Otwell· May 7, 2017, 05:49 PM+1−1cef1055182
src/Illuminate/Auth/Notifications/ResetPassword.php+1 −1
@@ -46,7 +46,7 @@ public function toMail($notifiable)
     {
         return (new MailMessage)
             ->line('You are receiving this email because we received a password reset request for your account.')
-            ->action('Reset Password', route('password.reset', $this->token))
+            ->action('Reset Password', url(config('app.url').route('password.reset', $this->token, false)))
             ->line('If you did not request a password reset, no further action is required.');
     }
 }

References