critical9.8Known exploitedPublic exploit code
CVE-2021-3129
Laravel Ignition File Upload Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2023-09-18. Federal due date: 2023-10-09.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Laravel 8.4.2 debug mode - Remote code execution2021-01-14 · webapps · php
Impact
Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Facade | Ignition | before 2.5.2 |
References
- NVD record
- CVE.org record
- CISA KEV catalog
- http://packetstormsecurity.com/files/162094/Ignition-2.5.1-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/165999/Ignition-Remote-Code-Execution.html
- https://github.com/facade/ignition/pull/334
- https://www.ambionics.io/blog/laravel-debug-rce
- http://packetstormsecurity.com/files/162094/Ignition-2.5.1-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/165999/Ignition-Remote-Code-Execution.html
- https://github.com/facade/ignition/pull/334
- https://www.ambionics.io/blog/laravel-debug-rce
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-3129