GHSA-p62r-7637-3wwc: 
PHP vulnerability analysis and mitigation

The vulnerability (GHSA-p62r-7637-3wwc) affects Laravel's 'remember me' cookie functionality in versions 4.0.0 to 4.1.26. The issue was discovered and disclosed on April 15, 2014, affecting the Laravel PHP framework. This vulnerability allowed hijacked authentication cookies to remain valid for extended periods, even after legitimate users performed security actions like password resets or logouts (GitHub Advisory).

The vulnerability is classified as moderate severity and is related to CWE-384. The issue specifically affects the 'remember me' cookie implementation in Laravel versions prior to 4.1.26. Before the security update, if a remember cookie was hijacked by a malicious user, it would remain valid for an extended period, regardless of the legitimate user's security actions. The vulnerability requires the addition of a remember_token column to the users database table for proper remediation (GitHub Advisory).

If exploited, this vulnerability allows an attacker who has hijacked a 'remember me' cookie to maintain persistent access to the victim's account, even after the legitimate user performs security-related actions such as logging out or changing their password. This could lead to unauthorized access to user accounts for extended periods (GitHub Advisory).

The vulnerability can be exploited if an attacker manages to hijack a user's 'remember me' cookie. The exploitation requires the attacker to have access to the victim's authentication cookie, which could be obtained through various means such as man-in-the-middle attacks or cross-site scripting (GitHub Advisory).

The vulnerability was patched in Laravel version 4.1.26. The fix introduces security improvements for 'remember me' cookies by implementing a new remember_token column in the users database table. After the update, a fresh token is assigned to users upon each login, and the token is refreshed when the user logs out. This ensures that if a 'remember me' cookie is hijacked, simply logging out of the application will invalidate the cookie (GitHub Advisory).