CyberRota Analysis
AI-GeneratedThe Laravel MagicLink feature, used for passwordless authentication and accessing private content, is vulnerable due to insufficient integrity protection when deserializing action objects in versions 2.0.0 to 2.25.1. An attacker with the ability to manipulate database records can exploit this vulnerability to execute arbitrary code by inserting malicious serialized objects. Organizations using affected versions should prioritize upgrading to version 2.25.1 to mitigate the risk of remote code execution.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Laravel MagicLink creates links for authentication without a password or for accessing private content. From 2.0.0 until 2.25.1, MagicLink stores serialized action objects in the magic_links.action database column and deserializes them through src/MagicLink.php and src/Actions/ResponseAction.php without sufficient integrity protection, while an unsafe legacy unserialize() fallback remains reachable. An attacker who can manipulate database records, such as through a separate SQL injection or compromised administrative access, can insert a malicious serialized object graph containing executable closure behavior; visiting the associated magic link then deserializes the record and can execute arbitrary code in the application process. The affected path is restricted to manipulated action records and does not independently provide database-write access. This issue is fixed in version 2.25.1.