Merge pull request #1842 from HackTricks-wiki/research_update_src_network-services-pentesting_pentesting-web_laravel_20260201_025419

Research Update Enhanced src/network-services-pentesting/pen...

Author: carlospolop

src/network-services-pentesting/pentesting-web/laravel.md

@@ -8,9 +8,9 @@ Read information about this here: [https://stitcher.io/blog/unsafe-sql-functions
 
 ---
 
-## APP_KEY & Encryption internals (Laravel \u003e=5.6)
+## APP_KEY & Encryption internals (Laravel >=5.6)
 
-Laravel uses AES-256-CBC (or GCM) with HMAC integrity under the hood (`Illuminate\\Encryption\\Encrypter`).
+Laravel uses AES-256-CBC (or GCM) with HMAC integrity under the hood (`Illuminate\Encryption\Encrypter`).
 The raw ciphertext that is finally **sent to the client** is **Base64 of a JSON object** like:
 
 ```json
@@ -161,6 +161,21 @@ Keep fuzzing key names (`files.__dot__0`, `files[0][0]`, `files[0][uuid]` …) u
 
 ---
 
+## Ecosystem package vulns worth chaining (2025)
+
+### CVE-2025-47275 – Auth0-PHP CookieStore tag brute-force (affects `auth0/laravel-auth0`)
+
+If the project uses **Auth0** login with the default CookieStore backend and `auth0/auth0-php` < **8.14.0**, the GCM tag on the `auth0` session cookie is short enough to brute-force offline. Capture a cookie, change the JSON payload (e.g., set `"sub":"auth0|admin"` and `app_metadata.roles`), brute-force the tag, and replay it to gain a valid Laravel guard session. Quick checks: `composer.lock` shows `auth0/auth0-php` <8.14.0 and `.env` has `AUTH0_SESSION_STORAGE=cookie`.
+
+### CVE-2025-48490 – `lomkit/laravel-rest-api` validation override
+
+The `lomkit/laravel-rest-api` package before **2.13.0** merges per-action rules incorrectly: later definitions override earlier ones for the same attribute, letting crafted fields skip validation (e.g., overwrite `filter` rules during an `update` action), leading to mass assignment or unvalidated SQL-ish filters. Practical checks:
+
+* `composer.lock` lists `lomkit/laravel-rest-api` <2.13.0.
+* `/_rest/users?filters[0][column]=password&filters[0][operator]==` is accepted instead of rejected, showing filter validation was bypassed.
+
+---
+
 ## Laravel Tricks
 
 ### Debugging mode
@@ -310,6 +325,8 @@ Another deserialization: [https://github.com/ambionics/laravel-exploits](https:/
 * [0xdf – HTB Environment (CVE‑2024‑52301 env override → auth bypass)](https://0xdf.gitlab.io/2025/09/06/htb-environment.html)
 * [GHSA-78fx-h6xr-vch4 – Laravel wildcard file validation bypass (CVE-2025-27515)](https://github.com/laravel/framework/security/advisories/GHSA-78fx-h6xr-vch4)
 * [SBA Research – CVE-2024-13919 reflected XSS in debug-mode error page](http://www.openwall.com/lists/oss-security/2025/03/10/4)
+* [CVE-2025-47275 – Auth0-PHP CookieStore tag brute-force (laravel-auth0)](https://www.wiz.io/vulnerability-database/cve/cve-2025-47275)
+* [CVE-2025-48490 – lomkit/laravel-rest-api validation override](https://advisories.gitlab.com/pkg/composer/lomkit/laravel-rest-api/CVE-2025-48490/)
 
 
 {{#include ../../banners/hacktricks-training.md}}