Laravel v5.4.36 vulnerabilities

[maxvisser]

$1: Acknowledgement

The decrypt function in laravel can be exploited. I scanned the code for this specific function, couldn't find any hits. If Valentin uses it in a next update please upgrade to a newer version of Laravel.

Resources:

https://medium.com/@taylorotwell/laravel-security-release-5-6-15-and-5-5-40-56f1257933a0

---

$2: Potential security risk

Laravel also misuses the remember_me token until 5.5.10 that sets it open for a timing attack.

I could find remember_me in the code: https://github.com/teamforus/forus-backend/search?utf8=%E2%9C%93&q=remember_me&type=

Resources:

laravel/framework#21320

Question: please check these vulnerabilities in laravel

[danrminds]

Functions not used currently

[maxvisser]

Thanks for checking.