CVE-2026-105222 in google-maps
Summary
by MITRE • 10/05/2026
The alexpechkarev/google-maps Laravel package through 12.16 disables TLS certificate verification by default because the bundled config sets ssl_verify_peer to FALSE, which is passed to CURLOPT_SSL_VERIFYPEER. On-path attackers can present any certificate to intercept Google Maps web-service requests, steal the API key from the query string, and tamper with responses.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/05/2026
The alexpechkarev/google-maps package for Laravel versions up through 12.16 contains a critical configuration flaw that fundamentally undermines the security of HTTPS communications when interacting with Google Maps web services. The vulnerability stems from the default value assigned to the ssl_verify_peer parameter within the bundled configuration file, which is explicitly set to false. This setting directly maps to the CURLOPT_SSL_VERIFYPEER option in the cURL library used by the package for making HTTP requests. By disabling peer certificate verification, the application fails to validate that the server presenting a TLS certificate actually owns the domain it claims to represent. Consequently, any client using this configuration will accept certificates from arbitrary sources without raising an alert or terminating the connection, effectively stripping away one of the primary mechanisms designed to ensure identity and integrity in encrypted communications.
This misconfiguration creates a severe risk for on-path attackers who can perform man-in-the-middle attacks against traffic between the Laravel application and Google Maps servers. Because certificate validation is disabled, an attacker positioned within the network path can intercept these requests and present their own self-signed or forged certificates without triggering security warnings in the cURL client. Once the connection is established under this false sense of security, the attacker gains full visibility into the encrypted traffic stream. This allows for the interception of sensitive data transmitted during API calls, most notably the Google Maps API keys embedded within query strings. The exposure of these credentials can lead to unauthorized usage of the service, resulting in significant financial costs due to billing abuse and potential depletion of quota limits intended for legitimate operations.
Beyond credential theft, the lack of certificate verification enables response tampering with severe operational consequences. An attacker can modify the data returned by Google Maps before it reaches the application logic. This could involve altering location coordinates, injecting malicious content into map displays, or returning fabricated place details to downstream users. Such manipulation compromises the integrity and availability of services that rely on accurate geospatial data. For applications handling logistics, navigation, or user-generated locations based on these APIs, this vulnerability can lead to incorrect routing decisions, financial losses from fraudulent transactions, or reputational damage due to unreliable service outputs. The flaw represents a classic instance where convenience in development configuration overrides essential security controls, leaving the system vulnerable to interception and modification of data in transit.
From a classification perspective, this issue aligns with CWE-295 Improper Certificate Validation, as the software does not properly verify that an entity is who it claims to be during TLS negotiation. It also relates to CWE-319 Cleartext Transmission of Sensitive Information because the API keys are transmitted in query strings over a connection where integrity and authenticity cannot be guaranteed. In terms of adversary tactics, this vulnerability facilitates MITM attacks as described in the ATT&CK technique T1072 Software Deployment Tools or more broadly under network sniffing techniques like T1040 Network Sniffing when combined with credential harvesting via T1539 Steal Web Session Cookie if session tokens were also exposed. The root cause is a default configuration error rather than complex code logic, highlighting the importance of secure defaults in third-party libraries and frameworks.
To mitigate this vulnerability, developers must immediately update to a patched version of the package where ssl_verify_peer is enabled by default or explicitly set it to true in their local configuration files overriding the bundle settings. It is crucial to ensure that all outgoing requests to Google Maps utilize valid TLS certificates issued by trusted certificate authorities. Additionally, organizations should audit their dependency management processes to identify other packages with similar insecure defaults and enforce strict security policies regarding SSL/TLS configurations across the entire application stack. Regular vulnerability scanning and static code analysis tools configured to detect disabled certificate verification can help prevent such misconfigurations from reaching production environments in the future.