laravel-mediable SSRF/XSS/LPE Vulnerability Fixes and Hardening Guide

Vulnerability Overview This web screenshot displays a security update for the library . This update provides a security fix, and upgrading is strongly recommended. The main security issues addressed are as follows: 1. SSRF Attack Protection: - Added the configuration, allowing remote URL source adapters to be restricted to a whitelist. By default, all hosts are allowed. - If the configuration list is not provided, will reject private IP addresses and localhost to prevent SSRF attacks. 2. Directory Traversal Attack Protection: - Directory validation now strips characters, preventing attackers from using directory traversal patterns to cause potential issues with certain file systems. 3. Custom Sanitizer Configuration: - Added the configuration, allowing the specification of custom Sanitizers to rewrite file contents before upload, removing security risks. - By default, the Sanitizer is applied to all uploaded SVG files. It can be disabled by removing it from the configuration. 4. SVG File XSS Protection: - Added , which strips executable JavaScript and other untrusted content from files, preventing stored XSS. 5. File Extension Blacklist: - Added the configuration and the method, allowing the specification of a blacklist of forbidden file extensions for upload. - By default, it includes some common executable file extensions to prevent remote code execution. 6. Double Extension Bypass Protection: - Forbidden file extensions are also sanitized in additional cases (e.g., becomes ), preventing double extension bypasses caused by common Apache and Nginx configuration errors. 7. MIME Type Blacklist: - Added the configuration and the method, allowing the specification of a blacklist of forbidden MIME types for upload. 8. Constant Migration: - The constants have been moved to the enum. 9. Class Refactoring: - Most instance properties in the class have been moved to that class. The class now accepts these as constructor parameters instead of an array. - now accepts instead of , to improve static analysis and type safety. Scope of Impact SSRF Attacks: Vulnerable to SSRF attacks if is not configured. Directory Traversal Attacks: Vulnerable to directory traversal attacks if directory validation is not performed. XSS Attacks: Uploaded SVG files may lead to stored XSS if is not used. Remote Code Execution: Vulnerable to remote code execution if is not configured. Double Extension Bypass: Vulnerable to bypasses via double extensions if additional sanitization is not enabled. MIME Type Bypass: Vulnerable to bypasses via MIME types if is not configured. Remediation 1. Configure : 2. Enable Directory Validation: Ensure directory validation is enabled to strip characters. 3. Configure : 4. Use : Ensure is enabled to strip executable content from SVG files. 5. Configure : 6. Enable Additional Sanitization: Ensure additional sanitization is enabled to prevent double extension bypasses. 7. Configure : 8. Update Constants: Move constants to the enum. 9. Refactor Class: Update the class to use properties from the class, and modify the method to accept . Full Code Block No POC code or exploitation code.

Goal Reached Thanks to every supporter — we hit 100%!

laravel-mediable SSRF/XSS/LPE Vulnerability Fixes and Hardening Guide

More from this source