CVE-2024-13918: Laravel Framework XSS Vulnerability

CVE-2024-13918 Overview

CVE-2024-13918 is a reflected cross-site scripting (XSS) vulnerability in the Laravel framework affecting versions 11.9.0 through 11.35.1. The flaw stems from improper encoding of request parameters rendered in the debug-mode error page. Attackers can craft URLs containing malicious payloads that execute JavaScript in a victim's browser when the debug page is displayed. The vulnerability is classified under [CWE-79] and was reported by SBA Research. Laravel addressed the issue in release v11.36.0.

Critical Impact
Attackers can execute arbitrary JavaScript in the browser of any user who visits a crafted URL against a Laravel application running with debug mode enabled, leading to session theft, credential capture, or account takeover.

Affected Products

Laravel Framework 11.9.0 through 11.35.1
Applications running with APP_DEBUG=true in production or staging
Web applications rendering Laravel's default debug-mode error page

Discovery Timeline

2025-03-10 - CVE-2024-13918 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13918

Vulnerability Analysis

The vulnerability exists in Laravel's debug-mode error rendering pipeline. When an unhandled exception occurs, Laravel displays a diagnostic page that reflects portions of the incoming HTTP request, including query parameters and request data. Versions between 11.9.0 and 11.35.1 fail to properly HTML-encode these reflected values before inserting them into the response body.

An attacker can trigger this behavior by inducing an error condition through a specially crafted request. Common triggers include invalid route parameters, malformed input types, or database exceptions. Successful exploitation requires user interaction, typically clicking a crafted link, and only affects deployments where debug mode remains enabled.

Exploitation impact includes cookie theft, session hijacking, phishing overlay injection, and unauthorized actions performed as the victim. See the SBA Research Security Advisory for the full technical writeup.

Root Cause

The root cause is missing output encoding in the debug error view. Request parameters flow directly into HTML context without passing through Laravel's standard e() helper or Blade's {{ }} escaping syntax. This breaks the fundamental separation between data and executable script content required to prevent [CWE-79] issues.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker crafts a URL targeting a Laravel application endpoint that will trigger an exception, embedding a JavaScript payload in a request parameter. When the victim visits the URL, the debug error page renders the payload as executable script in the browser session. The scope-changed nature of the flaw means executed script runs in the origin of the vulnerable application.

Code examples are not published in this advisory. Refer to the GitHub Pull Request #53869 for the exact code paths modified during remediation.

Detection Methods for CVE-2024-13918

Indicators of Compromise

HTTP request logs containing <script>, javascript:, onerror=, or onload= substrings within query parameters or POST bodies
Requests to application endpoints that produce 500-series responses paired with unusually large or encoded parameters
Referrer headers containing external domains preceding error responses on sensitive routes
Access log entries showing repeated exception-triggering requests with varied payload encodings

Detection Strategies

Scan production Laravel deployments for APP_DEBUG=true in .env configuration files
Inventory installed Laravel versions using composer show laravel/framework and flag versions between 11.9.0 and 11.35.1
Deploy web application firewall (WAF) rules that inspect query strings and form data for XSS signatures
Correlate 5xx error responses with parameter payloads containing HTML or JavaScript characters

Monitoring Recommendations

Alert on any production endpoint returning Laravel's Ignition or Whoops debug page in HTTP responses
Monitor egress traffic from browsers for anomalous requests to attacker-controlled domains following visits to your application
Log and review Content Security Policy (CSP) violation reports for inline-script executions
Track exception rates per endpoint and investigate spikes tied to specific source IPs or user-agents

How to Mitigate CVE-2024-13918

Immediate Actions Required

Upgrade the Laravel framework to v11.36.0 or later using composer update laravel/framework
Set APP_DEBUG=false in the .env file of all production and internet-facing staging environments
Rotate application session keys and force re-authentication if debug mode was previously exposed
Review web server logs for prior exploitation attempts against exception-triggering routes

Patch Information

Laravel released the fix in GitHub Release v11.36.0. The remediation is implemented in Pull Request #53869, which adds proper HTML encoding for request parameters rendered on the debug-mode error page. Additional coordination details are available in the OpenWall OSS Security notice.

Workarounds

Disable debug mode by setting APP_DEBUG=false in the production environment configuration
Restrict access to non-production Laravel environments using IP allowlists or VPN-only access
Implement a strict Content Security Policy that disallows inline scripts and untrusted script sources
Deploy a WAF rule blocking requests containing script tags, event handlers, or JavaScript URIs in query parameters

bash

# Configuration example
# Update Laravel to the patched release
composer require laravel/framework:^11.36.0

# Ensure debug mode is disabled in production .env
APP_ENV=production
APP_DEBUG=false

# Verify installed version
php artisan --version