Re:Laravel cookie forgery, decryption, and RCE
by cbg0 on Sunday April 20, 2014 @04:36PM
(#7618393)
Only sites which have error reporting enabled are vulnerable, so no need to panic unless you're displaying errors in production.
[ Parent
| on HN ]
Re:Laravel cookie forgery, decryption, and RCE
by iWKtMK on Sunday April 20, 2014 @04:55PM
(#7618447)
All sites were vulnerable to authenticating as other users or tampering with ciphertexts. Error reporting enables the RCE. However, I still hope that nobody is vulnerable or panicking since this was reported and fixed last year.