Skip to content

Known Exploited Vulnerability - Laravel Ignition Remote Code Execution - 20230919003

Overview

CISA has added CVE-2021-3129 to their Known Exploited Vulnerability Catalog.

Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents().

What is the vulnerability?

CVE-2021-3129 - NVD Base Score: 9.8

What is vulnerable?

The vulnerability is exploitable on sites using debug mode with Laravel before 8.4.2.

Recommendation

The WA SOC recommends administrators apply the solutions as per vendor instructions to all affected devices within expected timeframe of 48 hours... (refer Patch Management)

Additional Resources