Laravel Mass Assignment Vulnerability via JSON Column Nesting

A vulnerability exists in Laravel versions prior to 6.18.35 and in the 7.x branch prior to 7.24.0. The issue arises from improper handling of the $guarded property in certain situations involving requests with JSON column nesting expressions. This can lead to unexpected mass assignment of model attributes.

Impact

Exploitation of this vulnerability allows for unintended mass assignment of model attributes, potentially leading to unauthorized data modifications.

Remediation

Users can update to Laravel versions 6.18.35 or 7.24.0. It is recommended to use the $fillable property instead of $guarded for mass assignment protection.