cyfenced.com →

[ CVE-2021-3129 · Published 12 Jan 2021 ]

Laravel Ignition File Upload Vulnerability

Exploited · CISA KEV CVSS 9.8 EPSS 100%Fix available

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2023-09-18
  • Known to be used in ransomware campaigns
  • EPSS: 100% chance of exploitation in the next 30 days (higher than 100% of CVEs)
  • Critical severity: CVSS 9.8

[ Description ]Official description

Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.

CISA: Laravel Ignition contains a file upload vulnerability that allows unauthenticated remote attackers to execute malicious code due to insecure usage of file_get_contents() and file_put_contents().

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 9 Oct 2023): Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

[ References ]References