GHSA-5vrj-hxr4-wvrx: 
PHP vulnerability analysis and mitigation

Summary

When a model using HasChronicle was updated, the updated entry's diff took each field's old value from getOriginal(), which applies the model's casts. For an attribute with an encrypted cast, that is the decrypted value. Unless the attribute was listed in $hidden or $chronicleRedact, its previous value was written to the ledger in plaintext.

Who is affected

Applications that:

• use HasChronicle on a model with an encrypted cast (encrypted, encrypted:array, encrypted:collection, encrypted:object, AsEncryptedArrayObject, AsEncryptedCollection), and
• did not list that attribute in $hidden or $chronicleRedact, and
• updated that attribute while the package was on an affected version. Anyone who can read the ledger (database access, exports, or an audit UI) can read those values.

Patches

1.15.1 redacts encrypted cast attributes in diffs the same way as hidden attributes ([redacted] on both sides). Upgrade to 1.15.1 or later.

Entries already written

Ledger entries are immutable, so entries written before the upgrade keep the plaintext value.

• Payload encryption enabled (1.12.0 or later, chronicle.encryption.enabled): the diff is encrypted under the subject's key. php artisan chronicle:subject:erase makes that subject's entries unreadable, including these values. This also makes the rest of that subject's history unreadable.
• Payload encryption disabled: the values stay readable in the ledger. Treat them as exposed to anyone with read access to it, and rotate the underlying secrets where that matters (for example API tokens or credentials stored in encrypted casts). To find affected entries, look for updated entries of the affected models whose diff contains the encrypted attribute with a value other than [redacted].

Workarounds

Until you can upgrade, add encrypted cast attributes to $hidden or $chronicleRedact on the model.

Credit

Found while fixing laravel-chronicle/core#235, reported by @SkyLundy.