laravel/framework — pull request #6768 by GrahamCampbell (2014-12-21 20:19:44+00:00)
Title: [4.2] Fixed A Security Issue With The Encrypter

Recently, the issue of incorrect key length in the encrypted came up in the issues on GitHub. While this is not a security risk as such, it did bring something else to my attention. **An attacker may assume that a Laravel application still has the default key set**, thus allowing them to decrypt potentially sensitive data.

There is one application of this vulnerability in particular that could be very damaging. Knowing the encryption key would allow an attacker to **run any code on the system** in question if the user has an ironmq endpoint setup, because of course, then can not only decrypt information, but encrypt information too.

Obviously, if someone creates a laravel project via composer, we run "php artisan key:generate" for them, but if they clone a repo with git, or download a zip, they will never execute that command, and thus could potentially forget to set a key.

I propose that we actually implement a check in the encrypter class to check if the default key is still set, and throw an exception if it is. This pull request provides this implementation and tests.