Laravel Reflected XSS via Request Parameter in Debug-Mode Error Page

Vulnerability

Overview

The Laravel framework versions 11.9.0 through 11.35.1 contain a reflected cross-site scripting (XSS) vulnerability in the debug-mode error page. When APP_DEBUG=true and the application returns a 5xx HTTP error, the error page embeds request parameters—both URL query strings and request body data—directly into the HTML without proper encoding. The templating engine uses {!! !!} syntax, which disables HTML escaping, allowing attacker-controlled input to be interpreted as markup [1][4].

Exploitation

An attacker can craft a malicious link containing JavaScript payloads in a request parameter (e.g., a query string or POST body) and trick a user into clicking it. The user must be authenticated to the Laravel application, and the application must have debug mode enabled (APP_DEBUG=true). No special network position is required; the attack is remote and relies on user interaction [1][4]. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N) reflects the need for user interaction and debug mode [3].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the victim's browser within the origin of the affected web application. This can lead to session hijacking, data theft, or other client-side attacks. The impact is limited to the browser context, but the attacker can access sensitive information available to the user [1][4].

Mitigation

The vulnerability is fixed in Laravel version 11.36.0 [2][4]. Users should upgrade to the latest version immediately. As a workaround, debug mode should be disabled in production environments (APP_DEBUG=false), which eliminates the attack surface. No other workarounds are documented [1][3].