GHSA-r7jf-qg97-xhw9: 
PHP vulnerability analysis and mitigation

Impact

examples.faker_seed (default 1234) is applied through Faker's Generator::seed(), which calls mt_srand(). That seeds PHP's process-wide Mersenne Twister. Scribe reseeds it each time it hands out the generator, and also seeds the container's Faker and fake() for model factories. Nothing reseeds it randomly when generation ends. Running php artisan scribe:generate as its own process is not affected, because the process exits. The package also ships RegenerateDocumentation, which runs the command in-process through the console kernel, and the docs describe calling it from a queued job, a scheduled task or a request. On the sync, background or deferred drivers, that is the long-lived Swoole worker that serves HTTP. Afterwards, mt_rand(), rand(), array_rand(), shuffle() and str_shuffle() in that worker continue from a known seed. While generation runs, other coroutines in the same worker are repeatedly reset to the same sequence. Hypervel's own security-relevant randomness (Str::random, tokens, Arr::random) does not use the Mersenne Twister, so exploitation also needs application code that uses those functions for something secret, such as invite codes or one-time codes.

Root cause

• src/Extracting/SeededFaker.php calls $faker->seed($seed) on every hand-out.
• src/Extracting/InstantiatesExampleModels.php seeds the factory Faker instances.
• The finally block in src/Commands/GenerateDocumentation.php and RunState::flush() release the generator, but do not reseed mt_srand(). A related inconsistency: SeededFaker treats any falsy seed as unseeded, but InstantiatesExampleModels checks for null, so a seed of 0 still seeds the factories.

Patches

Fixed in 0.2.5. scribe:generate reseeds PHP's global Mersenne Twister randomly when it finishes, so a worker that ran it in-process no longer continues from the configured seed afterwards. A seed of 0 is now treated as unseeded by the model factories too, as the config documents. While generation runs, other coroutines in the same worker still draw from the seeded sequence: Faker 1.x can only seed the global generator. If the application uses mt_rand(), shuffle() or similar for anything secret, run generation in a process of its own (see Workarounds).

Workarounds

• Set examples.faker_seed => null. 0 is not enough, for the reason above.
• Run scribe:generate as a separate process, or send RegenerateDocumentation to a dedicated queue worker, not to the sync, background or deferred drivers.
• Call mt_srand() with no argument after any in-process Artisan::call('scribe:generate').