Laravel: Task Output Injection - Concurrency Process

Summary

If a concurrency task prints user-controlled text, an attacker can forge the framework's internal result message and achieve remote code execution in certain conditions

Pre-reqs

Insecure code and insecure handling of user provided input (devs trust user-provided input) :

1. App has a route that reaches Concurrency::run() (Not by default, it requires app code)

2. The task writes user-controlled data to stdout (echo/print/dd of input, hand-built JSON via string concat, passthrough of tool output), and the user-controlled bytes can be made to start the child's stdout and form a complete JSON document followed by \x1f\x8b (Not by default, requires the specific coding pattern in the app code)

Patches

• 13.40.0
• 12.71.0