POP Gadget using function injection in RequiredIf

June 12, 2021 ◦ 1 min ◦

Security

#laravel
#validation
#gadget chain
#RequiredIf
#Huntr
#bug bounty

Reported and fixed a vulnerability in Laravel where Illuminate\Validation\Rules\RequiredIf could be used as a gadget chain for deserialization vulnerabilities.

References:

https://huntr.dev/bounties/3-laravel/framework/
https://github.com/laravel/framework/pull/37688
https://github.com/laravel/framework/pull/37700
https://github.com/ambionics/phpggc/blob/c42dbd18538324c4337655651fe41ad54d081399/gadgetchains/Laravel/RCE/8/gadgets.php#L18