yeahhbean/laravel-cve-2018-15133Docker-based PoC environment for CVE-2018-15133 Laravel APP_KEY unserialization vulnerability. Includes exploit script to verify remote code execution via malicious payloads on Laravel <= 5.7.27.
White Hat School 3rd Term 28th Class Yebin Lee Virtualization - Vulnerable Docker Configuration https://github.com/yeahhbean/Laravel-CVE-2018-15133
This project is a Docker-based environment set up to verify (PoC) the CVE-2018-15133 vulnerability (Laravel APP_KEY deserialization vulnerability).
We built the vulnerable environment using only the Dockerfile and docker-compose.yaml, and confirmed that the PoC works correctly through the exploit.
The vulnerable environment is automatically installed and launched via the Dockerfile and docker-compose.yaml.
| File Name | Description |
|---|
| Dockerfile | For installing PHP + Composer + Laravel 5.7 |
| docker-compose.yaml | Configures all services (Nginx, PHP, MySQL) |
| nginx/default.conf | Nginx reverse proxy configuration file |
| exploit.py | PoC code based on APP_KEY |
Directory structure
Change directory cd C:\Users\Admin\Desktop\WHS\CVE
Build Docker image docker-compose build
Start Docker containers docker-compose up -d
Access container docker exec -it laravel_app bash
Exit container and run PoC exit python exploit.py
Access via browser Open a web browser and go to http://localhost:8080
# 1. Download the source and navigate to the directory
cd [project directory]
# 2. Build Docker image
docker-compose build
# 3. Start Docker containers
docker-compose up -d
Once successfully running, you can view the Laravel default page at http://localhost:8080.
# 1. Extract the Laravel APP_KEY from inside the container
docker exec -it laravel_app bash
cat /var/www/html/laravel/.env | grep APP_KEY
# 2. Use the extracted APP_KEY in exploit.py and run it
python exploit.py
# 3. If the Laravel page HTML is returned normally, it means the payload via APP_KEY was successfully delivered.
Versions after Laravel 5.7.28 have patched this vulnerability and it no longer works.
The PoC code (exploit.py) was written by referencing publicly disclosed attack methods.