Laravel Reflected XSS via Route Parameter in Debug-Mode Error Page

Vulnerability

Overview

The Laravel framework versions 11.9.0 through 11.35.1 are vulnerable to reflected cross-site scripting (XSS) in the debug-mode error page. The root cause is improper HTML encoding of route parameters when the application is in debug mode (APP_DEBUG=true) and returns a 5XX error. The error page embeds route parameter values directly into the HTML without sanitization, using Laravel's Blade templating engine with the {!! !!} syntax, which disables automatic escaping [1][4].

Exploitation

An attacker can craft a malicious URL containing JavaScript payloads in the route parameters. To exploit this, the target application must have debug mode enabled and must be induced to return an HTTP 5XX error (e.g., by triggering an exception). The victim must click the attacker-supplied link while authenticated to the application. The debug error page then renders the malicious payload, executing arbitrary JavaScript in the victim's browser within the origin of the affected web application [1][4].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's session. This can lead to theft of session cookies, exfiltration of sensitive data, or further actions within the application. The CVSS score is 8.0 (High) with vector AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N, reflecting the need for user interaction and debug mode [4].

Mitigation

The vulnerability was fixed in Laravel version 11.36.0 via pull request #53869 [2]. Users running affected versions should upgrade to 11.36.0 or later. As a workaround, disabling debug mode (APP_DEBUG=false) in production environments eliminates the attack surface, as the error page is not rendered [1][4].