CVE-2018-15133
Laravel Framework RCE Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2024-01-16. Federal due date: 2024-02-06.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- PHP Laravel Framework 5.5.40 / 5.6.x < 5.6.30 - token Unserialize Remote Command Execution (Metasploit)2019-07-16 · remote · linux · Verified
Impact
In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in `Illuminate/Encryption/Encrypter.php` and PendingBroadcast in `gadgetchains/Laravel/RCE/3/chain.php` in phpggc. The attacker must know the application key, which normally would never occur, but could happen if the attacker previously had privileged access or successfully accomplished a previous attack.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | laravel/framework | <= 5.5.40 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Laravel | Laravel | through 5.5.40 from 5.6.0 through 5.6.29 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- CISA KEV catalog
- http://packetstormsecurity.com/files/153641/PHP-Laravel-Framework-Token-Unserialize-Remote-Command-Execution.html
- https://laravel.com/docs/5.6/upgrade#upgrade-5.6.30
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-15133
- https://github.com/advisories/GHSA-qvqm-h22r-4cp9
- https://nvd.nist.gov/vuln/detail/CVE-2018-15133
- https://github.com/laravel/framework/commit/d84cf988ed5d4661a4bf1fdcb08f5073835083a0
- https://github.com/kozmic/laravel-poc-CVE-2018-15133