CVE-2020-19316

Vulnerability

The link() method in Illuminate\Filesystem\Filesystem.php (Laravel before 5.8.17) does not sanitize user-supplied $target and $link parameters when building a Windows mklink command. This allows an attacker to inject arbitrary OS commands via crafted inputs [1][2]. Affected versions: all Laravel versions before 5.8.17.

Exploitation

An attacker must have the ability to control the $target or $link parameters passed to the Filesystem::link() method. On Windows, the link() method uses exec() with a command string constructed using double quotes around the inputs [4]. Without escaping, an attacker can inject additional commands by including characters like &, |, or backticks. No authentication is required if the method is exposed via routes.

Impact

Successful exploitation allows remote attackers to execute arbitrary OS commands on the Windows server running the Laravel application. This leads to complete compromise of the application server, including data theft, modification, or further lateral movement [1][2].

Mitigation

The fix was released in Laravel 5.8.17, which uses escapeshellarg() on both parameters [4]. Users should upgrade to 5.8.17 or later. If upgrading is not possible, ensure that user input is never directly passed to Filesystem::link() or apply input validation to disallow special shell characters. The vulnerability is not listed on CISA's KEV.