Skip to main content

Use of software with known vulnerabilities in environments

Need​

Updating software and dependencies to versions without known vulnerabilities

Context​

  • Usage of PHP 7.1.3 for server-side scripting and web development
  • Usage of PHP for server-side scripting and web development
  • Usage of fideloper/proxy for setting up a reverse proxy server
  • Usage of Laravel framework for PHP web development
  • Usage of Laravel Tinker for interactive command-line debugging and exploration

Description​

Non compliant code​

<?php
// Assume that we are using Laravel 5.6.0, which has known vulnerabilities

composer.json

{
    "name": "laravel/laravel",
    "description": "The Laravel Framework.",
    "keywords": ["framework", "laravel"],
    "license": "MIT",
    "type": "project",
    "require": {
        "php": "^7.1.3",
        "fideloper/proxy": "^4.0",
        "laravel/framework": "5.6.*",
        "laravel/tinker": "^1.0"
    },
}

In the provided code snippet, we have a composer.json file which is used to manage the dependencies of a Laravel project.

In the require section of the file, we specify that the version of laravel/framework we want to use is 5.6.*. This means that we are using Laravel version 5.6.0 or any minor update within the 5.6 version series.

The vulnerability here is that Laravel 5.6.0 has known security vulnerabilities. By using this version of Laravel, we are exposing our application to these known vulnerabilities, which could potentially be exploited by attackers.

These vulnerabilities could lead to various issues such as SQL Injection, Cross-Site Scripting (XSS), Remote Code Execution (RCE), and more. As such, it is highly recommended to update to a more recent, secure version of Laravel.

Steps​

  • Identify the latest stable version of Laravel that does not have the known vulnerabilities.
  • Update the 'laravel/framework' version in the 'require' section of the 'composer.json' file to the identified version.
  • Run 'composer update' to update the Laravel framework to the new version.
  • Test the application thoroughly to ensure that the update does not break any existing functionality.

Compliant code​

// Updated composer.json file

{
    "name": "laravel/laravel",
    "description": "The Laravel Framework.",
    "keywords": ["framework", "laravel"],
    "license": "MIT",
    "type": "project",
    "require": {
        "php": "^7.1.3",
        "fideloper/proxy": "^4.0",
        "laravel/framework": "^8.0", // Updated Laravel version
        "laravel/tinker": "^1.0"
    },
}

The original code was using Laravel 5.6.0, which has known vulnerabilities. This poses a security risk as attackers can exploit these known vulnerabilities to compromise the system.

The updated code changes the version of Laravel used by the system to the latest stable version (8.0 at the time of writing) that does not have the known vulnerabilities. This is done by updating the 'laravel/framework' version in the 'require' section of the 'composer.json' file.

After updating the 'composer.json' file, you need to run 'composer update' to update the Laravel framework to the new version. This will download and install the new version of Laravel and update any dependencies as necessary.

Finally, it's important to thoroughly test the application after the update to ensure that the update does not break any existing functionality. This includes running all unit and integration tests, and manually testing any critical paths in the application.

References​

Last updated on