php-laravel-audit

PHP Laravel framework security audit (php-laravel-audit)

Analyze the "framework feature security mechanisms" and "common pitfall patterns" in Laravel project source code, focusing on:

• Authentication and route protection (middleware/auth/Policies/Gates)
• CSRF and token protection (VerifyCsrfToken, except list, differences between API and Cookie authentication)
• Session and Cookie security (session_regenerate_id, cookie flags, risk points of the remember mechanism)
• Eloquent mass assignment and request-to-model write flaws (Model::create/fill/update and $request->all() chain)
• Raw output and expression execution risks in Blade template rendering ({!! !!}、@php and unescaped output)
• Whether Laravel signed URL and route signature verification form a closed loop (Signed middleware and generation locations)

Input

User-provided:

• source_path: Laravel project source code root directory Optional:
• output_path: output directory path (default {source_path}_audit）

Output directory

Output to:

{output_path}/framework_audit/
  laravel_{timestamp}.md

Framework identification (required)

You must provide the evidence points by which you identify the project as Laravel (assertions without evidence are not allowed):

• composer.json dependency
• Typical directories:app/、routes/、config/
• Core entry points:public/index.php、bootstrap/app.php

Risk type mapping (required)

Each finding must clearly state:

• Applicable general type code:AUTH / CSRF / LOGIC / XSS / CFG / SESS / FILE etc. (from your shared/SEVERITY_RATING.md available type codes)
• Why this Laravel risk falls under that general type code (explain the mapping logic in one sentence)

Mandatory audit checklist (required: check each item and output results)

1) Authentication and authorization protection (AUTH)

The following evidence must be located and output:

• Protected route entry points:routes/web.php and routes/api.php in middleware('auth') / middleware('can') / Route::middleware([{value}])->group({value})
• Authorization logic:Gate:: / Policy / authorize / can / ->can({value}) location evidence
• Risk assessment: whether there is a pattern of "logged in but no resource-level ownership check" (for example, only checking that the user exists, not checking the owner)
• Route naming and resource binding: whether Route Model Binding is used but no ownership check is performed

Output requirements:

• If a deficiency is found: you must provide "location of the deficiency + request types that may be bypassed (GET/POST/API) + remediation suggestions"
• If not found: you must also output the "basis for determining that it was not found" (for example, except/guard is empty, sensitive routes all have middleware, etc.)

2) CSRF and token protection (CSRF)

Must locate:

• CSRF middleware：VerifyCsrfToken or equivalent middleware
• except list: which routes are excluded
• Differences between API and Cookie authentication: if the project uses Cookie/session for the API, confirm whether API routes are still protected by CSRF

Output requirements:

• Must cover "possible bypass branches": for example, only some methods are not validated, only certain Content-Types are not validated, skipping only during AJAX, etc.

3) Session and Cookie security (SESS)

Must locate:

• Session fixation protection after login: whether there is session_regenerate_id or Laravel equivalent mechanism evidence
• Cookie flags：HttpOnly/Secure/SameSite configuration location (config/session.php or custom middleware)
• logout: whether logout clears the session

4) Eloquent mass assignment（LOGIC）

Must locate and output data flow chain evidence:

• request input acquisition:$request->all()、$request->input({value})、json_decode({value})
• write model point:Model::create({value}) / Model::update({value}) / $model->fill({value}) / ->save()
• model fill strategy:$fillable / $guarded configuration location

Decision rule:

• $request->all() or equivalent input goes directly into create/fill/update, and the model lacks a denylist for sensitive fields (or $fillable is too broad), then output the risk

5) Blade raw output (XSS)

Must locate and output:

• raw output:{!! {value} !!}、@php as well as any "skip escaping" directives or callbacks
• User input source: from $request、request(), evidence when database field is backfilled but not escaped

Decision rule:

• If the raw output content contains user-controllable fields, and no e() or equivalent escape is applied, then output the risk mapped to XSS or related template injection risk (if your project uses template expression execution, map it to TPL）

6) Signed URLs and signature verification closed loop (AUTH or CFG)

Must locate:

• signed URL generation:URL::temporarySignedRoute / URL::signedRoute
• verification middleware:middleware('signed') or equivalent verification mechanism

Decision rule:

• If it is only generated but there is no signature verification middleware, or the verification logic can be bypassed, output the risk mapped to AUTH or CFG

Observable PoC (mandatory: framework effect observable verification framework)

Provide at least one of the following two categories and clearly state the observation point:

• Missing authentication/privilege escalation bypass: provide the real route and payload target (for example, switching the object id)
• Missing CSRF/bypass: provide the real route and the scenario of whether the token needs to be carried or not, and explain the observation point

PoC output requirements:

• Must include the real route (extracted from routes/*.php the real hittable location)
• Must include the real field names (such as the csrf field, or the form action)

Output completeness check (mandatory)

• Output includes: Laravel identification evidence points
• CSRF/Auth/Session/Mass Assignment/Blade raw/Signed URL all six major blocks have "check results"
• Each risk has: mapping type code + location evidence + observable verification framework + remediation suggestion