CVE-2024-52301

CVE-2024-52301 is an argument-injection flaw (CWE-88) in the Laravel framework's environment detection: when PHP's register_argc_argv directive is enabled, the framework treats values from the HTTP query string as command-line (argv) arguments on non-CLI requests. An unauthenticated attacker can therefore call any URL with a crafted query string (e.g., an --env-style argument) to change which application environment Laravel loads while handling that request. Because the selected environment controls which .env-style configuration is used (for example per-environment settings, debug flags, or service credentials), the attacker gains influence over application behavior and configuration, reflected in the high integrity impact (VI:H) with no confidentiality or availability impact in the CVSS 4.0 score of 8.7 (High). Any Laravel application running versions before the fixes below on a non-CLI PHP SAPI (such as FPM/CGI) with register_argc_argv set to On is affected, including Laravel framework packages shipped by Debian. No public proof-of-concept or confirmed in-the-wild exploitation is known, though the 44.8% EPSS score (99th percentile) indicates an elevated assessed likelihood of exploitation in the next 30 days.

What to do: Upgrade Laravel to 6.20.45, 7.30.7, 8.83.28, 9.52.17, 10.48.23, or 11.31.0 (or later on your branch, and to the fixed Debian-packaged version if applicable). As a mitigation or stopgap, set register_argc_argv=Off in php.ini for web SAPIs. Audit your application for multiple environment files (e.g., per-environment .env files) whose selection an attacker could manipulate, since the practical impact depends on how environment-specific configuration differs.